> ## Documentation Index
> Fetch the complete documentation index at: https://docs.akhara.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Company name is Akhara AI (never Rubric AI). Keep lowercase rubric/rubrics only when meaning grading criteria.
> Expert Review (docs path talent/) is enterprise BYO experts for audit and review: invite customer specialists; do not pitch Akhara recruiting or a public expert career portal. RLHF and domain writing are secondary work types.
> Prefer concrete API examples against public hosts: Environments eval API https://agi.akhara.ai, Control plane PDP https://api.akhara.dev, Evaluation https://app.akhara.ai / https://api.akhara.ai, Expert Review portal https://talent.akhara.ai.
> Do not invent a public hostname for private orchestrators or env API internals.
> Do not confuse control-plane latches with Environments confirmation latches.
> Environments SDK/API examples: curl against https://agi.akhara.ai. Evaluation SDK: from akhara import Akhara and AKHARA_API_KEY.
> Start with /llms.txt for the docs index and OpenAPI links; fetch individual pages as .md exports.

# Security overview

> Enterprise security across the Akhara suite: access control, data protection, tenant isolation, and deployment models including on-prem.

Akhara sits in the execution path of your agents. Every consequential step passes through the gateway before it runs, which means the gateway itself has to clear a higher bar than a dashboard or a log pipeline: it must be locked down, provable after the fact, and deployable inside your own network boundary when the data cannot leave.

This section documents that posture across the whole suite (Environments, Control plane, Evaluation, Expert Review).

## What is covered where

| Page                                                  | Covers                                                                  |
| ----------------------------------------------------- | ----------------------------------------------------------------------- |
| [Access and authentication](/security/access-control) | SSO, RBAC, MFA, org-scoped API keys, one-time permits                   |
| [Data protection](/security/data-protection)          | Encryption at rest and in transit, key management, redaction, retention |
| [Tenancy and isolation](/security/tenancy)            | Org boundaries, quotas, isolation defaults across products              |
| [Deployment models](/security/deployment-models)      | Managed cloud, dedicated VPC, on-prem and air-gapped                    |

Runtime enforcement itself, the part of the product that acts as a security control (fail-closed verification, latches on consequential actions, signed evidence, trajectory capture), is documented in the Control plane docs: see [interception](/control-plane/concepts/interception) and [audit and evidence](/control-plane/concepts/evidence).

## Compliance

Certification programs are underway; none are complete yet, and we state them that way:

* **SOC 2 Type II**: in progress
* **HIPAA**: BAA program in progress for customers handling PHI; see the [PHI/PII handling model](/evaluation/docs/architecture/phi-pii-handling) in the Evaluation docs for how the product treats PHI today
* **HITRUST CSF**: in progress

For current status, a completed security questionnaire (CAIQ, SIG), or a DPA, contact [security@akhara.ai](mailto:security@akhara.ai).

## Reliability

The managed cloud runs on AWS across multiple regions: a primary US region, a hot standby for disaster recovery, and a dedicated EU region for data residency. DNS-level health checks route around a failed region, databases run multi-AZ, and backups are encrypted and replicated cross-region. Live status and incident notifications are published at [status.akhara.ai](https://status.akhara.ai).

Because the control plane is [fail-closed](/control-plane/concepts/fail-closed), availability is also a safety property: if your runtime cannot reach the PDP, consequential actions are blocked rather than waved through.