ekai · Trust Center

Trust. Security. Transparency.

Last reviewed: September 2026

At ekai, we safeguard your data with industry-best practices, clear policies, and continuous improvement — built on a self-hosted architecture that keeps your data inside your own cloud.

Our trust commitments

Security first

Protecting infrastructure, applications, and data with industry-leading practices.

Privacy & compliance

Meeting global data-protection regulations and maintaining customer data sovereignty.

Transparency

Openly sharing policies, audits, and security controls with our customers.

Continuous improvement

Ongoing monitoring, testing, and security enhancements.

Trusted partnerships

Working with enterprise-grade subprocessors like Recall.ai for secure data handling. View subprocessors →

Security & infrastructure

ekai is self-hosted inside your cloud environment. You keep control of the infrastructure; we bring the controls, monitoring, and hardening by default.

Infrastructure & network security

Self-hosted in customer cloud environments with comprehensive access controls, monitoring, and system hardening.

Customer retains full control of infrastructure
Network segmentation and firewall protection
DDoS protection and monitoring
AWS WAF implemented with Defang
Unique authentication and MFA for all production systems
Authorized access controls for databases, OS, and network components
Prompt access revocation upon personnel termination
Encrypted remote access with mandatory MFA
Intrusion detection and comprehensive log management
Infrastructure monitoring with real-time alerts
Network and system hardening standards maintained
Annual security reviews and hardening assessments

Application security

Secure coding standards, continuous vulnerability scanning, and third-party security assessments.

Continuous vulnerability scanning
Secure coding standards and code reviews
Third-party security assessments by we45
Automated security testing in the CI/CD pipeline

Encryption & data protection

TLS 1.2+ for data in transit, AES-256 at rest, with comprehensive data-lifecycle management.

TLS 1.2+ for all data transmission
AES-256 encryption at rest
AWS Key Management Service integration
Customer-controlled encryption keys
Data classification and access restriction to authorized personnel
Data retention and disposal procedures established
Customer data deletion upon service exit
Sensitive data handling protocols
Data sovereignty maintained in customer environment

Identity & access management

SSO integration with customer identity providers and MFA enforcement.

Single Sign-On (SSO) integration
Google, Microsoft, and custom identity providers
Multi-Factor Authentication (MFA) support
Role-based access control (RBAC)

Incident response & monitoring

A formal incident-response plan with customer-initiated incident management.

Formal incident-response procedures
Customer-initiated incident management
24-hour SLA for enterprise support
Comprehensive logging and monitoring

Vulnerability & penetration testing

Continuous vulnerability scanning with independent security assessments.

Independent security assessments by we45 — VAPT report available on request
Regular penetration testing
Automated security monitoring
ADA-CASA assessment in progress — undergoing an App Defense Alliance CASA (Level 1) security assessment for Google API restricted-scope verification

Organizational security

Comprehensive personnel controls, asset management, and physical security measures.

Background checks for all personnel with access to production systems
Security-awareness training and annual performance evaluations
Code of conduct and confidentiality agreements
Production inventory maintained and regularly updated
Portable-media encryption and mobile device management (MDM)
Visitor sign-in procedures and badge requirements
Escorted access to secure areas enforced
Physical security controls and monitoring

Internal security procedures

Business continuity, change management, governance, and incident-response procedures.

Business continuity and disaster-recovery plans documented and tested
Cybersecurity insurance coverage maintained
Authorized, documented, and reviewed change-management procedures
Production deployment restrictions and testing requirements
Defined security roles and maintained security policies
Board oversight and regular risk assessments conducted
Vendor management and third-party risk assessments
Formal incident-management policies and procedures
Data backup procedures and system-change communication
Support resources and service commitments communicated to customers

Compliance & certifications

Since ekai is deployed in your environment, it leverages the compliance and security certifications already in place within your hosting infrastructure — including SOC 2, ISO 27001, HIPAA, PCI DSS, and GDPR where applicable. We implement the necessary measures by default to help you maintain and support these standards.

SOC 2 Type II ISO 27001 GDPR HIPAA PCI DSS

What we share

Some material is public; deeper artifacts are available under a confidentiality agreement.

Category	Public / general access	Gated / with permission
Certifications & attestations	Security overview, compliance status	Full audit reports, detailed assessments
Policies & procedures	Privacy policy, security overview	Internal control manuals, architecture diagrams
Security practices	Encryption standards, access controls	Penetration-test reports, threat models
Status & incidents	System status, incident summaries	Detailed postmortem reports

Frequently asked security questions

What encryption do you use?+

All data in transit is protected with TLS 1.2 or higher, and data at rest is encrypted with AES-256. Keys are managed through AWS Key Management Service and can be customer-controlled, so you hold ultimate control over your encryption keys.

How do you handle data deletion?+

Because ekai runs inside your own environment, your data never leaves your control. We maintain established data-retention and disposal procedures, and customer data is deleted upon service exit. Data is classified and access is restricted to authorized personnel throughout its lifecycle.

What is your backup and disaster-recovery plan?+

Business-continuity and disaster-recovery plans are documented and regularly tested, and data-backup procedures are in place. As ekai is deployed within your infrastructure, backup and recovery align with your environment's own DR posture, keeping data inside your perimeter.

How often do you perform security audits?+

We conduct annual security reviews and hardening assessments, run continuous vulnerability scanning, and commission independent assessments and regular penetration testing through our third-party partner, we45.

What happens in case of a data breach?+

We follow formal incident-response procedures with customer-initiated incident management and a 24-hour SLA for enterprise support. Comprehensive logging and monitoring support rapid detection, investigation, and notification in line with our incident-response plan.

Who are your third-party sub-processors?+

Because ekai self-hosts within your environment, sub-processor exposure is minimal. Recall.ai is used for secure meeting-data handling — see our subprocessors page for data types, retention, and deletion details, including Recall's own Trust Center.

How does self-hosting affect compliance?+

ekai leverages the compliance and certifications already in place in your hosting infrastructure — such as SOC 2, ISO 27001, HIPAA, PCI DSS, and GDPR where applicable. Data sovereignty is maintained within your environment, and we implement supporting controls by default.

What monitoring and logging capabilities do you provide?+

We provide intrusion detection, comprehensive log management, infrastructure monitoring with real-time alerts, and automated security monitoring across production systems.

What personnel security controls do you have in place?+

All personnel with access to production systems undergo background checks. We require security-awareness training, annual performance evaluations, a code of conduct, and confidentiality agreements, with prompt access revocation upon termination.

How do you manage business continuity and disaster recovery?+

Business-continuity and disaster-recovery plans are documented and tested, backed by data-backup procedures and cybersecurity insurance coverage.

What change-management procedures do you follow?+

Change management is authorized, documented, and reviewed, with production deployment restrictions and testing requirements to keep changes controlled and auditable.

How do you handle data retention and disposal?+

We maintain established data-retention and disposal procedures. Data is classified with access restricted to authorized personnel, and customer data is deleted upon service exit.

What asset and device management controls are in place?+

Production inventory is maintained and regularly updated. We enforce portable-media encryption and mobile device management (MDM), along with visitor sign-in, badge requirements, and escorted access to secure areas.

Contact the security team

Security
tech@yourekai.com

For security inquiries and incident reporting.

Support
hello@yourekai.com

General support and technical questions.

Ready to regain control of your data?

Private AI for regulated teams. Deploy ekai in your own cloud today.

Start free →