TIAKI operates a sovereign provenance infrastructure used by institutional allocators, regulators, and corporate boards. This page summarises the controls, processes, and architectural commitments that underpin that responsibility. It is intended for procurement, security, and compliance reviewers conducting institutional diligence.
Architecture & Hosting
- EU-hosted application and database infrastructure.
- HTTPS / TLS 1.2+ enforced end-to-end; HSTS recommended at the edge.
- Stateless front-end with code-split routes and content-security headers managed at the hosting layer.
- Logical isolation between public marketing surfaces and authenticated workspaces.
Data Protection
- Encryption in transit (TLS) and at rest (AES-256 on managed Postgres and object storage).
- Row-Level Security (RLS) enforced on every public-schema table; role separation between anon, authenticated, and service_role.
- Personal data minimised by default; access requests are captured with consent and an immutable audit trail.
- GDPR-aligned subject-rights handling; see the Data Processing Addendum.
Identity & Access
- Email / password authentication with optional TOTP multi-factor authentication for administrators.
- Principle of least privilege; admin actions gated by server-side role checks (not client storage).
- Tokenised, single-use, expiring download links for gated institutional research.
Audit & Observability
- Immutable audit log for access requests, approvals, downloads, and admin actions.
- Server-side rate limiting and anomaly logging on sensitive endpoints.
- Independent runtime error and security scanners executed on a continuous basis.
AI Governance
- Models are invoked via governed gateways; prompts and outputs are bounded by the published AI Output Disclaimer.
- No customer-confidential data is used to train external foundation models.
- Provenance and hash-divergence checks anchor every machine-generated artefact to a verifiable source set.
Compliance Posture
- Architected to support EU Article 8 / 9 (SFDR), CSDDD, eWpG, and STANAG-aligned disclosure obligations.
- Living regulatory register maintained across all six sovereign-risk verticals.
- Customer-facing legal terms are published and version-controlled — see Terms, Privacy, and DPA.
Responsible Disclosure
Security researchers and institutional reviewers may report suspected vulnerabilities to security@tiaki.ai. We acknowledge receipt within two business days and prioritise remediation by severity.
Procurement Contact
For full security questionnaires, sub-processor lists, or DPIA support, contact investors@tiaki.ai.