Ready to get started?
Deploy sovereign AI on your infrastructure - in weeks, not months.
ISO 27001 · 8 frameworks
Trust isn't a marketing page. It's the architecture, the audit log, the evidence pack, and the list of every subprocessor we use. This is the index. Each section below links to the actual artifacts.
For active customers under NDA, full evidence packs, certificates, and pen test reports are available through your CSM.
8
Compliance frameworks
ISO · GDPR · HIPAA · NDMO · BSP · EU AI Act · FedRAMP
0
Egress events
Validated quarterly across sovereign deployments
100%
Customer-owned data
We are processor, not controller
4×/yr
Pen tests
Independent · published to customers
📋
ISO 27001 certificate
Public certificate available below. Full Statement of Applicability under NDA.
Download certificate →🔐
Pen test report
Independent quarterly testing. Latest summary available; full report under NDA.
Request via CSM →🌐
Sub-processors list
Current list available on request. Contact your CSM or reach out to request the full list.
Request via CSM →🛡
Security whitepaper
Architecture, controls, encryption, and operations. PDF download.
Read whitepaper →📜
Data Processing Agreement
Standard DPA aligned to GDPR Article 28. Custom DPAs available.
Request DPA →Honest status. Frameworks we're attested for, frameworks in process, and frameworks that don't apply to a B2B platform with no payment processing.
ISO/IEC 27001
Global
Certified · annual
SINCE 2022
GDPR
EU + UK
Compliant · DPA + SCC
SINCE 2018
HIPAA
United States
BAA-ready
SINCE 2024
EU AI Act
European Union
High-risk class · ready
SINCE 2025
NDMO
Saudi Arabia
Compliant · classification
SINCE 2023
BSP Circular 1166
Philippines
Compliant · banking AI
SINCE 2024
FedRAMP Moderate
US Federal
In process · Q3 2026
SINCE 2026
ISO 42001 (AI MS)
Global
Certification target · 2026
SINCE 2026
PCI DSS
Global · payments
N/A · we don't process payments
Need a framework not listed here? Sovereign deployments support custom framework mappings. Talk to us about custom compliance →
Active customers get full evidence packs through their CSM. Prospects evaluating Katonic for a regulated workload can request the relevant subset under a mutual NDA. Auditors and regulators contact us directly.
