Security & operations
Boring, on purpose.
The most important property of your system's security is that there's nothing exciting to say about it. Here is how hosting, data flow, and operations actually work, written for your CISO, your DPO, and your procurement team.
Hosting & isolation
Every client system runs in its own single-tenant environment: separate infrastructure, separate storage, separate credentials. No shared databases, no pooled indexes, no cross-tenant anything. The environment is built during your engagement and is part of what you own. It can be exported and re-deployed inside your own infrastructure at any time.
Models at inference
Which models see your data is a design decision you make with us, per engagement. Options range from frontier-lab APIs under enterprise terms (zero data retention, no training on inputs, contractually) to open-weight models running entirely inside your environment, where nothing leaves at all. The trade-offs, capability, cost, residency, are laid out in the validation charter before we build.
Subprocessors
The full list of subprocessors for your system (cloud provider, model providers, monitoring) is fixed in your data-processing agreement and doesn't change without notice to you. We keep the list short on purpose.
Operations & continuity
We monitor, patch, back up and operate every hosted system. Service levels (uptime, response times, backup and recovery points) are agreed per engagement in writing. And because you own the full source, models and documentation, continuity doesn't depend on us existing: any competent engineering team could take over operation with the handover materials alone.
Certifications
Cyber Essentials certified; ISO 27001 alignment is our current operating baseline with certification in progress. If your procurement requires specific attestations, ask, the fastest way to find out is a direct conversation with the people who built the system.
Your rights over your data
Export everything, any time, data, models, code, configuration. Deletion on request, confirmed in writing. Full audit access to your own system's logs. These aren't support tickets; they're properties of owning the system.
Procurement questionnaire, data-flow diagram, or DPA review? contact@elver.ai . You'll get an engineer, not a PDF portal.