This page is written for CISOs and security architects: where data is stored, what crosses your perimeter, who holds the keys, what an AI agent can and cannot do, how we handle incidents — and how to verify all of it before you sign.
The six questions every security review starts with, answered directly.
In the deployment option you choose: BlackGust Cloud in-region, your private cloud, your own servers, or an air-gapped environment. Personal data stays in the jurisdiction its law requires.
No. Cloud models are accessed through enterprise APIs whose terms exclude training on customer data. Local models run entirely inside your infrastructure. Fine-tuning on your corpus happens only in your environment and only when you ask for it.
Only the fragments needed to answer. Personal data is masked before it leaves. In air-gapped deployments, external calls are disabled completely.
Only the named engineers on the project, as agreed with you and for the duration of the work. All access is logged and revoked at handover.
Data is encrypted in transit and at rest. In private-cloud, on-premises and air-gapped deployments, your organization holds the keys.
At the end of the contract, data is deleted within the agreed period and a deletion certificate is issued.
Four options, four trust boundaries. The dashed line is your perimeter. Read each diagram as an answer to three questions: what leaves, what is masked, and where the keys live.
Fastest start. The platform runs in our cloud in the region you choose.
The platform runs in your cloud tenant, under your network and identity policies.
The platform and local models run on your servers in your data center.
An isolated network with no internet route. Local models only.
The same platform, the same controls — what changes is who operates the infrastructure and where the boundary sits. Use this table to pick the mode that fits your risk appetite.
| Control | BlackGust Cloud | Private cloud | On-premises | Air-gapped |
|---|---|---|---|---|
| Data | ||||
| Data residency | Your chosen region | Your tenant | Your data center | Your isolated network |
| Encryption in transit and at rest | ✓ | ✓ | ✓ | ✓ |
| Who holds the keys | BlackGust, in-region | You | You | You |
| Masking before external model calls | ✓ | ✓ | ✓ | No external calls |
| Isolation from the internet | ||||
| Identity and access | ||||
| SSO via SAML / OIDC | ✓ | ✓ | ✓ | ✓ |
| Roles from your directory, row- and field-level access | ✓ | ✓ | ✓ | ✓ |
| Network policy under your control | — | ✓ | ✓ | ✓ |
| Models | ||||
| Frontier models (OpenAI, Anthropic) via enterprise APIs | ✓ | Optional | Optional | — |
| Local open-weight models | Optional | ✓ | ✓ | ✓ |
| Operations | ||||
| Full audit log, exportable to your SIEM | ✓ | ✓ | ✓ | ✓ |
| Who operates the infrastructure | BlackGust | You, with our engineers | You, with our engineers | You, our engineers on site |
| Speed to first deployment | ||||
AI agents add new attack surface to familiar systems. This is a summary of the threat model we share in full with your team, with the controls mapped to each threat.
AttackInstructions hidden in a user message, an email, a web page or an uploaded document try to override the agent's rules.
AttackAn attacker tries to pull data out through answers, links, tool calls or the model provider.
AttackAn agent or user tries to perform actions beyond their role, or chains tools to reach a system of record.
AttackTampered model weights, poisoned fine-tuning data or a compromised software dependency.
AttackA confident but wrong answer leads to a bad business decision or an incorrect document.
AttackSomeone at the vendor, or an over-privileged administrator, reads data they shouldn't.
An agent never gets more rights than the person it acts for. Every limit is set in configuration and enforced by the platform, not by the model.
| Time | Agent | Requested action | Decision |
|---|---|---|---|
| 09:14:02 | Finance assistant | Read Q3 ledger, branch North | Allowed |
| 09:14:09 | Finance assistant | Read payroll, all branches | Denied · role |
| 09:21:47 | Procurement agent | Payment above $500,000 | Held · CFO approval |
| 09:22:15 | Mail agent | Send contract to external domain | Held · owner approval |
| 09:30:03 | Support agent | Grant itself admin role | Denied · policy |
The platform does not invent a second identity system. People sign in the way they already do, and access follows the roles you already manage.
Sign-in through your identity provider. Multi-factor rules, session length and conditional access stay under your policy.
Groups and roles come from Active Directory, LDAP or your identity provider. Leavers lose access when you disable them there.
Access is restricted by system, object, row and field. A regional manager sees their region; salary fields stay hidden from those without rights.
Each agent has a declared scope of data and actions. It acts with the intersection of its scope and the user's rights — never the union.
Read-only by default. Write rights granted per action, documented and visible in the audit log.
Changing an agent's permissions and approving the change are different roles. Every change is logged with who, what and when.
The audit log is the evidence base for your security team, your auditors and your regulators. It records what happened in enough detail to reconstruct any answer or action.
Alerts for denied actions, unusual query volumes and repeated override attempts can be routed to your SOC. SIEM export is included in the Enterprise and Sovereign packages.
Incidents are handled under a written plan agreed with you before go-live. Notification timelines are fixed in the contract so your own regulatory deadlines — such as GDPR's 72 hours for controllers — can be met.
Monitoring, alerts from your SOC, or a report from a user or our engineer.
Severity classified against the agreed scale; the duty engineer takes ownership.
Affected agent, connector or access suspended. Evidence preserved from the audit log.
You are informed without undue delay, with what we know and what we don't yet know.
Root cause fixed, reference tests re-run, release approved by your side.
A written post-incident report with timeline, impact, root cause and actions.
| Foundation | Enterprise | Sovereign | |
|---|---|---|---|
| Coverage | Business hours | 24/7 for critical incidents | 24/7 |
| Critical incident response | Next business hours | 24/7, per contract | 1 hour |
| Named duty engineer | — | — | ✓ |
| SSO and SIEM export | — | ✓ | ✓ |
| Written post-incident report | ✓ | ✓ | ✓ |
| Impact and security review | Quarterly | Monthly | Continuous, embedded team |
Package details and annual prices are on the pricing page.
Every piece of data the platform touches has a defined path, a retention period and an end.
Connectors read from your systems with least-privilege accounts. Only the sources agreed for each use case are indexed.
Data is encrypted in transit and at rest. Personal data is masked before any external model call.
Answers are filtered by the user's rights. Every access is written to the audit log.
Index, conversations and logs are kept for the periods set in the contract, matched to your retention policy.
At the end of the period or the contract, data is deleted within the agreed time and a deletion certificate is issued.
We design the platform to support compliance with the main data-protection and AI laws in Europe, the Americas and Asia-Pacific, and we provide documentation for your DPIA and other assessments. We do not certify compliance — the legal assessment remains yours.
| Regulation | Region | What reviewers usually ask | How we design to support it |
|---|---|---|---|
| GDPR | EU / EEA | Lawful basis, minimization, processor terms, transfers, DPIA | In-region or on-prem processing, processor agreement, masking, deletion, DPIA input pack |
| EU AI Act | EU | Risk classification, human oversight, logging, transparency to users | Human approval enforced in configuration, full logs, AI disclosure in user channels, technical documentation |
| PIPL | China | Localization, cross-border transfer rules, sensitive data | In-country deployment on local models, no calls to foreign APIs, logs and keys in-country |
| APPI | Japan | Purpose of use, security measures, transfers abroad | Purpose recorded per agent, access control and logs, in-country deployment |
| PIPA | Korea | Purpose limitation, safety measures, cross-border transfer | On-prem or air-gapped, field-level access, complete access logs |
| LGPD | Brazil | Legal basis, data-subject rights, impact report | In-country deployment, processing records per use case, deletion on request |
| Privacy Act & APPs | Australia | Use and disclosure, security, cross-border disclosure | Australian region or on-prem, access control, logs for your privacy impact assessment |
| CCPA / CPRA | California, US | Notice, consumer rights, service-provider terms, automated decision-making | Service-provider terms, deletion and access support, human review of significant decisions |
| Sector rules | Health, finance, public sector | Sector-specific confidentiality and record-keeping (e.g. HIPAA-style rules) | Deployment inside your accredited environment, retention and access matched to the rule |
We'll send the documentation pack under NDA, complete your security questionnaire, and an engineer can meet your security team before the contract is signed.
Components, deployment options, network boundaries and data-flow diagrams for your chosen mode.
The full version of the summary above, with controls and residual risks.
In your format, or a standard one your team prefers.
Your testers or your chosen firm test the pilot environment; we fix findings and support the retest.
Data-processing agreement, list of subprocessors, and an input pack for your DPIA or impact assessment.
Incident response plan, staff access rules and the deletion-certificate template.
We don't hold SOC 2 or ISO 27001 certification. Instead we deploy into environments you control and give your team everything needed to assess us directly.
Request security documentationNo. Frontier models are accessed through enterprise APIs whose terms exclude training on customer data. Local models run inside your infrastructure. Fine-tuning on your corpus happens only in your environment, at your request.
No. We say so openly. To compensate, we deploy in environments you control — private cloud, on-premises or air-gapped — and give your team the architecture, threat model, completed questionnaire and access to our engineers, plus cooperation with your penetration test.
Yes, in private-cloud, on-premises and air-gapped deployments the keys stay in your key management service or HSM. In BlackGust Cloud, keys are managed by BlackGust in the same region; if you must hold them yourself, choose one of the other modes.
Yes. We agree scope and timing, your testers or your chosen firm test the pilot environment, we fix findings and support the retest.
We assume it will be attempted. Retrieved content is treated as data, not instructions; inputs are filtered; and, most importantly, agents cannot exceed the user's rights or take risky actions without human approval. A successful injection hits the same walls as any user.
Without undue delay, within the timeline fixed in the contract so you can meet your own regulatory deadlines. In the Sovereign package, critical incidents get a 1-hour response from a named duty engineer.
It depends on the mode. With frontier models, the model provider's enterprise API is a subprocessor; in BlackGust Cloud, so is the hosting provider in your region. In on-premises and air-gapped deployments without frontier models, there are none. The full list is in the DPA.
Only named engineers, for the agreed period, with logged access that is revoked at handover. In air-gapped deployments they work on site under your supervision and access rules.
Yes. The audit log exports to your SIEM in standard formats, and retention follows your policy. SIEM export is part of the Enterprise and Sovereign packages.
Modules, model routing and the four deployment options.
Open →Public sectorSovereign architecture, jurisdictions and procurement for public bodies.
Open →CostWhat each package includes, from SLA to SIEM export.
Open →AnswersEverything else buyers ask before the first meeting.
Open →Send your questionnaire or ask for the documentation pack. An engineer will walk your team through the architecture and threat model.