Security & Trust
Regulated industries demand this. We built for it
SOC 2 Type I certified. Hosted in Frankfurt (ISO 27001). Zero-trust architecture, encryption and tenant separation – technically enforced and contractually assured.
Data protection & security
Privacy is architecture. Built for regulated industries.
Data protection is architecture, not a feature. The platform connects to your core systems, CRM and apps and runs where your supervisor expects it to.
Privacy by design
✓
Consent per purpose
✓
Hosted in Frankfurt
✓
PII filter before the model
✓
No cross-tenant training
01
GDPR & DPA
A data processing agreement, purpose limitation and deletion concepts are part of every project, with a joint data protection impact assessment on request. Every use of customer data is tied to a documented purpose and a consent.
02
Hosted in Frankfurt
Private cloud in the ISO 27001 certified data center in Frankfurt, on-premise optional. Data stays in Germany.
03
PII filter before the model call
Personal data is detected and masked before a language model sees a request. No cross-tenant training: customer data only trains the customer's own models – as a technical restriction and as a clause in the DPA.
04
Tenant separation
Each customer runs in its own logically separated environment with its own keys, roles and logs.
05
SOC 2 Type I certified
ACCELERAID is SOC 2 Type I certified; the report is available under NDA. Audit-proof logging is included in every deployment: data access, model inference, agent actions and configuration changes, exportable. Log retention 1 year, individual in the Enterprise package.
06
Enterprise hosting
Enterprise hosting in the PCI DSS certified data center. The ISO 27001 and PCI DSS certifications apply to the data center.
Decisions only use data with a documented purpose and consent and run within defined rules. Automated individual decisions within the meaning of Art. 22 GDPR are not intended; assessing individual processing activities is up to your data protection officer.
The agreed configuration, the contract and the related evidence, such as the SOC 2 Type I report, are authoritative.
ARCHITECTURE
How we protect your data — layer by layer
Layer 1 — Access Control
No one has standing access to production. Ever
Zero-trust means every request is authenticated and authorised individually. Role-based access controls. Principle of least privilege. Just-In-Time (JIT) privileged access — elevated permissions exist only for the duration of a specific task, then expire automatically.
Role-based permissions and least privilege. IAM via secure sessions over TLS.
ACCESS CONTROL MODEL
Zero-trust
No implicit trust. Every request authenticated individually.
Just-In-Time access
Elevated permissions expire immediately after use.
Least privilege
Every role has the minimum access it needs. Nothing more.
MFA enforced
Mandatory for all accounts. No exceptions.
ENCRYPTION STACK
TLS
TLS 1.3 in transit
All data encrypted in motion.
AES
AES-256 at rest
Encryption of data at rest.
PII
Field-level PII firewall
Redaction before any model touches data.
DE
Frankfurt, Germany
ISO 27001-certified data centre Frankfurt (Leaseweb); Enterprise: dedicated hardware cluster or your data centre.
Layer 2 — Data Security
Encrypted everywhere. Separated by design
Encrypted in transit and at rest, tenants logically separated. Pseudonymisation and data minimisation are standard; personal data is filtered and redacted at field level before it reaches a model.
Layer 3 — AI Governance
AI that is explainable, auditable and containable
Every AI-supported score includes a traceable explanation with feature importance. No automated individual decisions under Art. 22 GDPR. No black boxes.
Geo-restrictions ensure model requests and responses remain within permitted jurisdictions. Sensitive Data Scanner detects PII in model prompts and applies automatic redaction or alerts before inference.
AI GOVERNANCE CONTROLS
Explainability by default
Feature importance for every prediction – documented and traceable.
EU AI Act risk classification
Documented per module – ACCELERAID operates no high-risk AI systems.
AI risk assessment
Documented methodology per module. Available on request.
Model registry
Full version history and governance documentation on demand.
SECURITY CONTROLS
Five domains. Independently audited
Covered in our SOC 2 Type I report. Full documentation in the Trust Center.
INFRASTRUCTURE
• Encryption keys restricted & logged
• MFA enforced, all accounts
• Prod access restricted
• Network & firewall controls
• DDoS protection
• BC/DR tested annually
PRODUCT
• Secure SDLC
• 3rd-party pen testing
• Responsible disclosure
• Patch management automated
• Incident response plan
ORGANISATION
• NDA — all staff & contractors
• Security awareness training
• Code of Conduct enforced
• Risk management programme
• Anti-malware & endpoint encryption
• Mobile device management
DATA & PRIVACY
• DPA signed before processing
• Data deleted at contract end
• Data classification policy
• SCCs for international transfers
• Data subject rights workflows
• Retention procedures
AI GOVERNANCE
• AI policy & framework
• Risk assessment per module
• Explainability & bias monitoring
• EU AI Act risk classification
• Contractual clause: no cross-tenant use
• Model registry & versioning
REGULATORY COMPLIANCE
The frameworks we align with
GDPR, DORA, EU AI Act, MaRisk and SOC 2 – addressed in architecture and operations. Industry-specific frameworks such as PSD2 are covered on the respective industry pages.
GDPR by design
Privacy by design. PII filtering, consent management, data subject rights (Art. 15–22). Every AI output explainable under Art. 22. Technical and organisational measures audited.
Built for DORA-regulated institutions
Designed for ICT risk management under DORA: incident response plan, annually tested BC/DR procedures, regular third-party penetration tests, sub-processor list and support for outsourcing audits.
Aligned with the EU AI Act
EU AI Act risk classification documented per module – ACCELERAID operates no high-risk AI systems. Human oversight, bias monitoring and model documentation are standard.
Aligned with MaRisk
Aligned with MaRisk requirements: data governance, model documentation and support for outsourcing audits (AT 9).
SOC 2 Type I certified
Independently audited for security, availability, processing integrity, confidentiality and privacy. Full report via the Trust Center under NDA.
OPERATING MODELS
Your infrastructure. Your rules
You decide where your data lives – data residency contractually assured in the DPA.
OPTION 01
Private Cloud
Standard: ISO 27001-certified data centre in Frankfurt. Enterprise: dedicated hardware in the Adtelligence Cloud, in a data centre that is additionally PCI DSS-certified.
OPTION 02
On-Premises
Full operation inside your own data centre, on request. No outbound connections required. CDP, AI models, reporting, orchestration – everything runs inside your perimeter. Preferred for the highest data sovereignty requirements.
OPTION 03
Hyperscaler
Operation in your Azure or GCP environment with an EU region, on request. Data residency contractually assured in the DPA.
TRUST CENTER
Everything for your security review – in the Trust Center
17 years of working with regulated companies in Europe: we know security questionnaires, procurement checklists and IT security reviews. The Trust Center holds the documents your team needs for its assessment.
SOC 2 Type I report (under NDA)
Penetration test attestation letter
Data Processing Agreement (DPA)
Security policy documentation
Sub-processor list
ISO 27001 / PCI DSS certificates of the data centre operator (on request)
VERIFIED TRACK RECORD
17
Years of AI experience
250+
Enterprise projects
We support our clients in audits – with documentation, evidence and named contacts.
Does ACCELERAID train models on my data?
Where exactly is my data stored?
What certifications does ACCELERAID hold?
How does ACCELERAID handle GDPR Art. 22 for AI decisions?
Is ACCELERAID built for DORA-regulated institutions?
Can ACCELERAID be operated fully on-premises?
What happens to our data when we end the contract?
Do you conduct penetration testing?
Read on
Where to go next.
From the blog
AI & Banking
Regulation as a Moat: How the GDPR and the EU AI Act for Banks Create an Advantage
Data & Technology
AI Context Layer in Banking: What a Banking Agent May Remember and What It Must Forget
Data & Technology