Security
How IRAME protects your data
SOC 2 Type II and ISO/IEC 27001:2022, with independent VAPT. Run IRAME in its cloud in any region, in your own cloud tenancy, or on-premise with on-premise AI models.
SOC 2 Type II is a report from an independent audit over a full period. ISO/IEC 27001 is a certification of how IRAME manages information security.
SOC 2 Type II
Audited
An independent CPA firm examined IRAME's controls over a full observation period against all five AICPA trust services criteria: security, availability, processing integrity, confidentiality and privacy.
ISO/IEC 27001:2022
Certified
IRAME's information security management system is certified to ISO/IEC 27001:2022 by an accredited body.
Independent VAPT
Tested
Independent vulnerability assessment and penetration testing against OWASP Top 10 and NIST guidance. Every finding tracked to closure.
To request the current reports and certificate, email sales@irame.ai.
Three deployment options. When IRAME runs in your environment, your data stays there.
IRAME's cloud
A single-tenant environment hosted by IRAME. Fastest to start.
Your own cloud tenancy
A dedicated private instance inside your Azure, AWS or other public cloud subscription. Your data never leaves it.
On-premise
IRAME runs on your own servers with on-premise AI models. No data leaves your building.
In the cloud, the application, data and AI models are pinned to the region you choose, such as the US, the EU, the UAE, Saudi Arabia, Qatar or India, under local data residency rules. Private network (VPC) deployment and access through your own virtual desktop (VDI) are also available.
Data is encrypted, access is set by role, connections are read-only and our systems are tested independently.
Encryption in transit and at rest
Customer data is encrypted on the network and in storage.
Access set by role
Client admin, auditor, process owner or reviewer: each user sees only what the role allows.
A log of every action
Every action in IRAME is logged: who did what, and when.
Read-only connections
Connections to SAP, Oracle, NetSuite and your data lake are read-only. Nothing in your ERP changes.
Retention you control
Six months by default, shorter or longer on request. The DPA sets out how data is deleted or returned.
AI governance
What legal, risk and IT ask before approving an AI tool, answered by how IRA behaves.
Your data never trains a model
IRA, IRAME's agentic AI, uses enterprise model endpoints such as Azure OpenAI, under terms that exclude customer data from training. Prompts and results never improve anyone's model.
Models run where your data runs
In the cloud, the model endpoint sits in your data's region. On-premise, IRAME runs on-premise models on your servers.
No open-web access
IRA works only on the data you connect. It does not search the open internet or third-party databases while testing your controls.
Deterministic tests, AI at the edges
A control runs as saved, versioned logic: same data, same control, same result every run. The model helps build the test and write it up; it does not decide the result.
A human approves every action
IRA cannot start a workflow, send a message, post an entry, approve or pay on its own. A person approves each control before it is saved and reviews each finding before it is reported.
Every step is explainable
Each result shows the data used, the steps taken and why a row was flagged. IRA's instructions and memory are visible in the Knowledge Hub.
Need data to stay in one country? See how IRAME handles data sovereignty.
Report a security issue
Email admin@irame.ai with the details. The same contact is in our security.txt file.
What security teams ask first
Which certifications does IRAME hold?
IRAME is SOC 2 Type II audited against all five trust services criteria and certified to ISO/IEC 27001:2022. Independent penetration tests run against OWASP Top 10 and NIST guidance. To request the current reports under NDA, email sales@irame.ai.
Where does IRAME keep our data?
IRAME runs in IRAME's cloud, as a dedicated private instance in your own cloud tenancy, or on-premise with on-premise models. In the cloud, application, data and AI models are pinned to one region, so data stays in-country.
Is our data used to train AI models?
IRAME never uses customer data to train models. It calls enterprise model endpoints, such as Azure OpenAI in your region, under terms that exclude customer data from training.
Can the AI take actions on its own?
IRAME's AI, IRA, cannot start workflows, send messages, post entries, approve or pay on its own. A person approves each control before it is saved and reviews each finding before it is reported.
Which systems does IRAME read data from?
IRAME reads SAP, Oracle, NetSuite, data lakes such as Snowflake and Azure Data Lake, Excel and CSV files, PDFs and scans, and Outlook email archives (PST). Connections are read-only.
Who at our company can see what?
IRAME gives each user a role, such as client admin, auditor, process owner or reviewer, that sees only what it needs. Every action is logged.
How long does IRAME keep our data?
IRAME keeps data for six months by default, and you can change that. When the work ends, data is deleted or returned under the DPA.
How do we report a security issue?
IRAME takes security reports at admin@irame.ai, also listed in /.well-known/security.txt.
Questions about data sources and setup are on the FAQ page.
Stop sampling. Let IRA test everything.
Bring one process. In 30 minutes we show you the exceptions IRA finds and the evidence behind each one.