Trust Center

Security is Architecture, Not a Feature.

Every layer of ShadowTagAI is built for zero-trust data sovereignty. From encryption at rest to tenant isolation — security is structural, not bolted on.

Compliance

Certifications & Standards

🛡️

SOC 2 Type II

Annual audit covering security, availability, and confidentiality trust service criteria.

Certified
🇪🇺

GDPR Art. 28

Data Processing Agreements and EU residency options for international deployments.

Compliant
🏥

HIPAA

BAA-ready infrastructure with PHI safeguards for healthcare litigation data.

Compliant
⚖️

ABA Rule 1.6

Architecture preserves attorney-client privilege during AI-assisted legal operations.

By Design
Defense in Depth

Six Pillars of Security

Every request passes through multiple independent security boundaries before reaching compute.

Encryption at Rest & Transit

AES-256 for data at rest. TLS 1.3 for all transit. CMEK available for Enterprise tier.

Privilege Preservation

Zero-knowledge LLM routing. Heppner-compliant guardrails ensure privilege is never compromised.

Immutable Audit Trails

Every AI interaction cryptographically logged with tamper-evident checksums for regulatory review.

Tenant Isolation

Firm data logically and cryptographically isolated. Dedicated compute pools for Enterprise.

Data Residency

Choose US, EU, or APAC. Data never leaves your jurisdiction without explicit consent.

Zero-Trust Access

RBAC with MFA. SSO via SAML 2.0 & OIDC. Session tokens rotate every 15 minutes.

⚖️

Heppner-Compliant by Architecture

Following Heppner v. Agentic Systems, Inc. (S.D.N.Y. 2026), ShadowTagAI implements mandatory privilege-preservation guardrails at the infrastructure level. Zero-knowledge LLM routing ensures no model retains, trains on, or indexes privileged communications — verified by independent audit.

Infrastructure

Google Cloud Native Stack

ComponentTechnology
Cloud ProviderGoogle Cloud Platform
ComputeCloud Run (serverless, auto-scaling)
DatabaseFirestore + Cloud Spanner
CDN / EdgeCloud Armor + Firebase Hosting
WAF4 Cloud Armor security rules
MonitoringCloud Monitoring + 8 alert policies
CI/CDCloud Build with signed artifacts
SecretsGCP Secret Manager (FIPS 140-2)
Data Governance

Jurisdictional Compliance

🇪🇺

GDPR

30-day deletion queue via Cloud Tasks. Data Processing Agreements. Right to erasure with cryptographic verification. EU data residency available.

🇺🇸

CLOUD Act

All data stored on GCP in customer-selected jurisdiction. Transparent government request policies. Legal challenge commitments for overreach.

🗑️

Zero Data Retention

Session data processed in RAM only. Cryptographic shredding on session end. No model training on customer data. Zero-retention by default.

Ready for a Security Review?

See Our Security in Action.

Schedule a deep-dive with our engineering team. We'll walk through architecture, provide audit documentation, and answer every question.

Request Security Review Back to Home