Security and sovereignty
When in doubt,
Altorium says no.
If an identity, a permission or an approval is missing, the operation stops. That is the default behaviour, not an option you have to switch on.
Six controls on every operation.
01 · Isolation
Each company in its own space
Queries, caches, events and results never cross from one company or project to another.
02 · Permissions
Explicit roles
Who queries, who approves and who administers are defined separately. Nothing is inherited by default.
03 · Approval
No change without a person
Actions that change a system require explicit approval, tied to that specific action.
04 · Audit
Persistent evidence
Sensitive operations leave a durable record of who, what, when and with what outcome.
05 · Credentials
The model never sees your keys
Passwords and API keys are stored encrypted and used by reference. They never appear in prompts or answers.
06 · Connections
Authorised destinations only
Each connector can only talk to the servers you have registered.
Sovereignty
European infrastructure. Clear accounts.
Where your data is. On Arsys infrastructure in Spain, a provider certified to ISO/IEC 27001 (information security), ISO/IEC 27018 (protection of personal data in the cloud) and the Spanish National Security Framework (ENS) at High level.
Which AI models are used. Models are served from the IONOS AI Model Hub, part of the IONOS group that Arsys belongs to, in EU data centres. Every use is logged.
Who else is involved. We publish our list of sub-processors and give notice before changing it.
AI Act. Human approval, a record of the model used and per-task traceability are built into the architecture, to help you meet your obligations.
Documentation for your legal team.
Found a vulnerability?
Send us the details. We will reply and keep you informed while we fix it.