---
title: "Security and compliance: GDPR, HIPAA, SOC 2, ISO 27001"
description: "How inference.eu protects your data: encryption, isolated execution, audited access, no training on your data, and our GDPR, PCI DSS, HIPAA, SOC 2 and ISO 27001 status."
canonical: "https://inference.eu/security/"
language: "en"
---

Security

# Security and compliance

Your models and agents run with your data, your credentials and your integrations. Here is how we protect them, and where we stand on GDPR, PCI DSS, HIPAA, SOC 2 and ISO 27001.

[Contact sales](https://inference.eu/contact/)[Compliance](#compliance)

1.  01Encrypted in transit and at rest
2.  02Processed in EU data centres
3.  03Never used for training

## How we protect your data

-   ### Encrypted everywhere

    All data is encrypted in transit with TLS 1.2 or later and at rest with AES-256. Secrets use envelope encryption with key rotation.

-   ### Isolated execution

    Agents run in sandboxed containers: minimal base images, non-root processes and no shared state between customers.

-   ### Audited access

    Every sign-in, permission check and data access is logged, and alerts fire automatically on suspicious patterns.

-   ### Enterprise SSO

    SAML 2.0 single sign-on, so your identity provider decides who has access, with one login across the platform.

-   ### No training on your data

    Your inputs and outputs are yours. We don't use customer content to train models or share it with third parties.

## Reporting a vulnerability

If you've found a security issue in the API, the web app, agents or the MCP connections, please tell us through the contact form and choose "Not sure yet" as the topic. Include a description, steps to reproduce, the affected component and what an attacker could do. We acknowledge reports within 48 hours and aim to give a fix timeline within 5 working days.

## Disclosure policy

We follow coordinated disclosure, so please give us reasonable time to fix an issue before publishing it. We won't take legal action against researchers acting in good faith, and we credit researchers in our changelog unless they prefer to stay anonymous.

## Policies

We maintain an information security policy, an incident response policy, a data classification policy, a vendor management policy, a business continuity policy and a change management policy. Full documents are available under NDA for enterprise evaluations and compliance reviews.

## Compliance

GDPR

Compliant

PCI DSS

Compliant

HIPAA

BAA available

SOC 2

In progress

ISO 27001

In progress

## Common questions

The questions buyers, developers and legal teams ask us most. Something missing? Ask us directly.

In data centres in the European Union. Requests, outputs and logs stay in the EU.

No. Customer content is used only to answer your requests and is never used to train a model or shared with third parties.

Yes. Every customer gets one DPA covering all models, agents and connections they use.

Both are in progress. We can share our security policies under NDA in the meantime, and we'll update this page when the audits are complete.

Yes, a business associate agreement is available. Get in touch and tell us about your use case.

Yes. Policy documents are available under NDA for enterprise evaluations and compliance reviews. Ask through the contact form.

[Ask a question](https://inference.eu/contact/)

## Move your AI workloads to EU infrastructure

Tell us which models you use and roughly how much traffic you have. We reply within one working day with pricing and next steps.

-   Reply within one working day
-   Pricing for your volume
-   DPA ready to sign