Security isn't a feature we added. It's the architecture we started with.
The same platform runs in commercial enterprise, regulated industries, and government. Compliance is a property of the platform โ not a project to bolt on later.
Your data stays in your environment. AI runs inside your boundary. Asset IDs never reach the LLM. Every action logged. Every access traced. SOC 2 Type II, HIPAA, and GDPR certified โ aligned with NIST CSF 2.0, NIST AI RMF, FedRAMP, and ISO 42001.
Six properties of the platform that make xAQUA safe to deploy in your environment โ from a 50-person startup to a $300B public agency.
These are the design rules engineering enforces in code. They aren't policies you can override in production. When a proposed change would violate an invariant, the answer is no.
ToolContext is intentionally minimalasset_id, asset_type, query. Nothing else. Context bloat is how routing layers turn into application layers.All AI traffic in xAQUA flows through a single LLM Gateway. The Gateway sanitizes outbound prompts, attaches usecase telemetry, applies guardrail policy, and attributes cost โ for every call, every time.
The Gateway is the only path from xAQUA to any LLM โ self-hosted or otherwise. You can audit, redact, throttle, or block at one place instead of policing every module.
customer_id, user_id, LLM_USECASE_CONTEXT, and LLM_USECASE_SUBCONTEXT โ driving telemetry, cost attribution, and guardrail policy.In xAQUA, the answer is the same one you started with. We don't move it. We don't copy it. We don't store it. The platform sits on top of where your data already lives.
The exact list โ independently audited certifications, formal alignments, and active in-progress assessments. No vague claims. Evidence available under NDA in the Trust Center.
Not just compliant in theory. Deployed in the industries where compliance is the deal โ and the failure mode is on the front page.
Audit reports under NDA. Architecture deep-dives on request. Penetration test results, SBOM, and DPA available before contract.