Security & Trust
Regulated industries demand this. We built for it
SOC 2 Type I certified. Hosted in Frankfurt (ISO 27001). Zero-trust architecture, encryption and tenant separation – technically enforced and contractually assured.
No cross-tenant use of your data.
Not as a promise in a blog post — as a technical constraint and a clause in your contract. Customer data is never used across tenants or for foundation models; customer-specific models are trained exclusively on your own data.
Logically separated.
Customer data is stored and processed with logical separation; access is restricted per tenant.
Audit-proof logging. Not an add-on.
Data access, model inferences, agent actions and configuration changes are logged in an audit-proof way and can be exported. Log retention 1 year, custom in the Enterprise package. Included in every deployment — not sold separately.
ARCHITECTURE
How we protect your data — layer by layer
Layer 1 — Access Control
No one has standing access to production. Ever
Zero-trust means every request is authenticated and authorised individually. Role-based access controls. Principle of least privilege. Just-In-Time (JIT) privileged access — elevated permissions exist only for the duration of a specific task, then expire automatically.
Role-based permissions and least privilege. IAM via secure sessions over TLS.
ACCESS CONTROL MODEL
Zero-trust
No implicit trust. Every request authenticated individually.
Just-In-Time access
Elevated permissions expire immediately after use.
Least privilege
Every role has the minimum access it needs. Nothing more.
MFA enforced
Mandatory for all accounts. No exceptions.
ENCRYPTION STACK
TLS
TLS 1.3 in transit
All data encrypted in motion.
AES
AES-256 at rest
Encryption of data at rest.
PII
Field-level PII firewall
Redaction before any model touches data.
DE
Frankfurt, Germany
ISO 27001-certified data centre Frankfurt (Leaseweb); Enterprise: dedicated hardware cluster or your data centre.
Layer 2 — Data Security
Encrypted everywhere. Separated by design
Encrypted in transit and at rest, tenants logically separated. Pseudonymisation and data minimisation are standard; personal data is filtered and redacted at field level before it reaches a model.
Layer 3 — AI Governance
AI that is explainable, auditable and containable
Every AI-supported score includes a traceable explanation with feature importance. No automated individual decisions under Art. 22 GDPR. No black boxes.
Geo-restrictions ensure model requests and responses remain within compliant jurisdictions. Sensitive Data Scanner detects PII in model prompts and applies automatic redaction or alerts before inference.
AI GOVERNANCE CONTROLS
Explainability by default
Feature importance for every prediction – documented and traceable.
EU AI Act risk classification
Documented per module – ACCELERAID operates no high-risk AI systems.
AI risk assessment
Documented methodology per module. Available on request.
Model registry
Full version history and governance documentation on demand.
SECURITY CONTROLS
Five domains. Independently audited
Covered in our SOC 2 Type I report. Full documentation in the Trust Center.
INFRASTRUCTURE
• Encryption keys restricted & logged
• MFA enforced, all accounts
• Prod access restricted
• Network & firewall controls
• DDoS protection
• BC/DR tested annually
PRODUCT
• Secure SDLC
• 3rd-party pen testing
• Responsible disclosure
• Patch management automated
• Incident response plan
ORGANISATION
• NDA — all staff & contractors
• Security awareness training
• Code of Conduct enforced
• Risk management programme
• Anti-malware & endpoint encryption
• Mobile device management
DATA & PRIVACY
• DPA signed before processing
• Data deleted at contract end
• Data classification policy
• SCCs for international transfers
• Data subject rights workflows
• Retention procedures
AI GOVERNANCE
• AI policy & framework
• Risk assessment per module
• Explainability & bias monitoring
• EU AI Act risk classification
• Contractual clause: no cross-tenant use
• Model registry & versioning
REGULATORY COMPLIANCE
The frameworks we align with
GDPR, DORA, EU AI Act, MaRisk and SOC 2 – addressed in architecture and operations. Industry-specific frameworks such as PSD2 are covered on the respective industry pages.
GDPR by design
Privacy by design. PII filtering, consent management, data subject rights (Art. 15–22). Every AI output explainable under Art. 22. Technical and organisational measures audited.
Built for DORA-regulated institutions
Designed for ICT risk management under DORA: incident response plan, annually tested BC/DR procedures, regular third-party penetration tests, sub-processor list and support for outsourcing audits.
Aligned with the EU AI Act
EU AI Act risk classification documented per module – ACCELERAID operates no high-risk AI systems. Human oversight, bias monitoring and model documentation are standard.
Aligned with MaRisk
Aligned with MaRisk requirements: data governance, model documentation and support for outsourcing audits (AT 9).
SOC 2 Type I certified
Independently audited for security, availability, processing integrity, confidentiality and privacy. Full report via the Trust Center under NDA.
OPERATING MODELS
Your infrastructure. Your rules
You decide where your data lives – data residency contractually assured in the DPA.
OPTION 01
Private Cloud
Standard: ISO 27001-certified data centre in Frankfurt. Enterprise: dedicated hardware in the Adtelligence Cloud, in a data centre that is additionally PCI DSS-certified.
OPTION 02
On-Premises
Full operation inside your own data centre, on request. No outbound connections required. CDP, AI models, reporting, orchestration – everything runs inside your perimeter. Preferred for the highest data sovereignty requirements.
TRUST CENTER
Everything for your security review – in the Trust Center
17 years of working with regulated companies in Europe: we know security questionnaires, procurement checklists and IT security reviews. The Trust Center holds the documents your team needs for its assessment.
SOC 2 Type I report (under NDA)
Penetration test attestation letter
Data Processing Agreement (DPA)
Security policy documentation
Sub-processor list
ISO 27001 / PCI DSS certificates of the data centre operator (on request)
VERIFIED TRACK RECORD
17
Years of AI experience
250+
Enterprise projects
We support our clients in audits – with documentation, evidence and named contacts.
Does ACCELERAID train models on my data?
Where exactly is my data stored?
What certifications does ACCELERAID hold?
How does ACCELERAID handle GDPR Art. 22 for AI decisions?
Is ACCELERAID built for DORA-regulated institutions?
Can ACCELERAID be operated fully on-premises?
What happens to our data when we end the contract?
Do you conduct penetration testing?
Read on
Where to go next.
From the blog
Automation
The AI Orchestration Layer in Banking: Router, Planner, Domain Agents, Reviewer, and Who Is Responsible for What
Data & Technology
Mastercard AN4569 and Visa's Enhanced Merchant Data: When the Bank Has to Explain Every Transaction
AI & Banking
AI Decision Engine in Banking: Five Building Blocks, One Audit Trail and the Real-Time-or-Batch Question
Ready for your security review?
Talk to our security experts or see the platform in a demo.