Trust Center
Security, privacy, and compliance at Phana Velocity
This page reflects Phana Velocity's current security posture. Items that are planned or in progress are clearly marked as roadmap or available on request — we don't publish anything we can't stand behind. Detailed documentation is available to qualified prospects under mutual NDA.
Compliance & Certifications
SOC 2 Type II
In progressAudit in progress — independent CPA firm engaged, target completion Q4 2026. Report available under NDA upon completion. (Security, Availability, and Confidentiality criteria; observation period underway.)
Built on certified AWS services
Phana Velocity is built on AWS services that are themselves SOC 2, ISO 27001, HIPAA-eligible, and PCI DSS certified. These certifications belong to AWS as the underlying cloud provider.
Framework coverage (product capability)
The platform helps customers comply with 78+ frameworks including SOC 2, ISO 27001, HIPAA, PCI-DSS, GDPR, DORA, and NIS2. This describes what the product supports for customers — it is not a statement that Phana itself holds these certifications. Only SOC 2 is an active Phana company engagement (see above).
AI & Data Governance
How Phana Velocity's AI agents process your data — the detail most buyers ask about first.
In-region, private inference
All LLM inference runs through AWS-managed, in-region services over private network endpoints — never third-party public LLM APIs.
Model-agnostic by design
We run best-of-breed foundation models, selected for accuracy and updated over time as the field evolves. Every model runs in-region under the same no-training, stateless-inference, and private-network guarantees — your data never touches third-party public LLM APIs.
No training on your data
Customer inputs and outputs are not used to train or fine-tune foundation models. Inference is stateless — no conversation history or document content is persisted between invocations.
Tenant-scoped retrieval
Retrieval is tenant-scoped: every query is filtered by tenant, so the model never receives another tenant's documents, credentials, or secrets.
Our no-training and stateless-inference guarantees are backed by our underlying AI platform's service terms.
Data Security & Encryption
Encryption at rest & in transit
AES-256 at rest with customer-managed encryption keys and automatic rotation. TLS 1.3 in transit across the platform.
Dedicated keys
Dedicated per-tenant encryption keys are available on Enterprise plans.
Secrets management
Secrets and credentials are stored in a dedicated, encrypted secrets vault, and internal service calls are authenticated and short-lived. Audit logs are retained.
Infrastructure & Hosting
Hosting & regions
Hosted on AWS with regional hosting available in India, the United States, Europe, and the Middle East. Your data is stored and processed in the region you select and remains within that region.
Backup & durability
Point-in-time recovery and object versioning are enabled across our data stores. Specific backup cadence and cross-region replication are available on request.
Multi-Tenant Isolation
Phana Velocity is logically multi-tenant. Tenant data is isolated at every layer:
- Every record and file is scoped to a single tenant
- Every request is authorized against the requesting tenant
- Deny-by-default role-based access control
- Fail-closed checks block any cross-tenant access
Access Control & Identity
Authentication
Identity and authentication are managed through a dedicated identity service. Multi-factor authentication is configurable per tenant, recommended for production, and can be enforced per tenant or role. Strong password policies and token rotation are enforced throughout.
Authorization
Access is governed by deny-by-default role-based access control across six roles.
SSO / SAML
Federation via SAML 2.0 and OpenID Connect (OIDC) is available, with tested support for Okta, Microsoft Entra ID, Ping Identity, and Google Workspace. A built-in local user directory is also available for managing users directly in the platform.
Subprocessors
The only data-plane subprocessor is Amazon Web Services, Inc. All customer data is processed within AWS — across cloud hosting and encrypted storage, managed AI inference, authentication, and transactional email. Customer data is stored and processed in the customer's selected region (India, United States, Europe, or Middle East) and remains within it.
The 78+ supported systems (Okta, GitHub, Datadog, and others) are customer-connected data sources — the customer's own systems that the product reads evidence from. They are integrations, not Phana subprocessors.
Security Testing & Monitoring
Continuous security testing
AvailablePhana runs continuous automated security testing — internal (code- and design-aware) and external — through AWS's security agent, with SAST and automated threat modeling on every change, plus triage and remediation of findings. Detailed reports are available under NDA.
Documentation & Reports
Detailed security documentation is available to qualified prospects under mutual NDA. Select what you need below and our team will follow up — we don't offer instant downloads. We also continuously monitor platform availability and notify affected customers of incidents directly.
Responsible Disclosure
If you believe you've found a security vulnerability, please report it to security@phana.ai (monitored inbox). We ask that you give us reasonable time to investigate and remediate before any public disclosure.