Security built forregulated industries.
Your data, your model and your institutional knowledge, protected at every layer by default.
Every record,protected by default.
Your data trains nothing
Customer data never trains any model, including Heravox's own.
Data stays in your environment
Heravox runs on your infrastructure; you decide where data lives.
Encrypted in transit and at rest
Databases and backups included.
Only masked text leaves Türkiye
Choose a model outside Türkiye and personal data is masked before it leaves your environment.
Least-privilege access
SSO, mandatory multi-factor sign-in for local accounts and role-based permissions.
Tested every year
Annual independent penetration tests and continuous control monitoring.
Built to standardsand regulation.
Trust center (opens in a new tab)- ISO/IEC 27001Information security managementIn progress
- ISO/IEC 42001AI management systemIn progress
- ISO 9001Quality managementIn progress
- KVKKIn line with
- GDPRIn line with
- EU AI ActIn line with
Runs in your data center.You choose the language model.
The model runs on your own GPUs and Heravox manages it; data never leaves.
What security teamsask most.
Ask us anything elseDeployment and data
- Where is our data stored and processed?
- On-premises, in your environment: databases, files, backups and logs stay on your servers. In the cloud, data and backups stay in Türkiye, in an environment reserved for you alone. Either way the data is yours: you can take all of it or have it deleted at any time.
- Does Heravox need an internet connection?
- No. The installation package ships with every image, and the licence is verified offline. When the model runs in your environment, every path that could send data outside it is switched off in the on-premises profile.
- Is our data used to train models?
- No. Customer data is never used to train any model, including Heravox's own.
- Are connections encrypted?
- Yes. External traffic and database connections use TLS, with certificates issued by your own certificate authority. Calls between services are signed.
- Can personal data end up in logs?
- No. Application logs carry no review text or personal data, and every release is tested against this rule.
- Do you use subprocessors?
- Not in an on-premises installation where the model runs in your environment: customer data never leaves your infrastructure, and Heravox has no subprocessor that touches it. If you choose a model outside your environment, masking is optional for the Heravox TR model in Türkiye, and only masked text reaches AWS Bedrock abroad.
Access and audit
- Does it connect to our identity provider?
- Yes, over SAML 2.0, OIDC, CAS and LDAP / Active Directory. Multi-factor sign-in is mandatory for local accounts.
- How are permissions assigned?
- From the groups in your identity provider. Roles are mapped again at every sign-in, and users who match no role cannot get in.
- Can the Heravox team see our data?
- We have no standing access to your environment. Administrator accounts belong to your system administrators. When support is needed, access is opened only through your privileged-access process and only for the duration of the request.
- Can we send audit logs to our SIEM?
- Yes. Sign-ins and admin actions can be searched and exported from the admin screen. The same events stream to your SIEM over syslog (TLS) or as JSON; if the SIEM is unreachable, events wait in a queue.
AI
- Which model do we use?
- The one you choose: a model on your own GPUs managed by Heravox, an internal endpoint your team runs, the Heravox TR model dedicated to you in Türkiye, or your organisation's AWS Bedrock account.
- When is personal data masked?
- Always when text is going to a model outside Türkiye (AWS Bedrock), before it leaves your environment. For the Heravox TR model in Türkiye masking is optional; if the model runs in your environment, data never leaves.
- Does Hera act on its own?
- No. It asks for your approval before opening a task, a case or a report.
- Are AI outputs traceable?
- Yes. Every classification records which model and which prompt version produced it.
Development and operations
- How is code developed and reviewed?
- Every change needs a second person's approval and passes automated tests. Source code goes through static analysis, dependency vulnerability scanning and secret scanning.
- What happens if there is a security incident?
- We handle incidents under a documented response process. If an incident affects you, we notify you in writing within the period set in your contract.
- Do you share your security documentation?
- Yes. We share our security policies and the annual independent penetration test report under NDA.
Releases and continuity
- How do we verify the software we receive?
- Every release ships with image digests and a software bill of materials (SBOM). You verify in your own environment that the images you install are the ones we delivered.
- How do security updates arrive?
- As versioned packages. Critical and high-severity fixes are backported to supported releases, and you decide when to install them.
- How do backup and recovery work?
- The database is backed up continuously and can be restored to a point in time. Restored data is checked automatically against table and row counts.
- How is disaster recovery planned?
- We set the recovery time objective together, based on your organisation's disaster recovery design, and verify it with an annual exercise.
- What happens to our data when the contract ends?
- On-premises, it is already in your environment: you can export all of it in open formats and delete it under a documented destruction procedure. In the cloud, we hand all of it over to you, then delete your environment and backups and confirm the deletion in writing.