The answer your compliance officerhas been waiting for.
Every Specialist runs on AWS Bedrock. Conversation turns, cited sources, and approval decisions are recorded in your audit log. Compliance posture monitoring checks your own AWS environment against HIPAA, SOC 2, GDPR, NIST 800-53, ISO 27001 and CIS control families. These are evaluation tools, not audit attestations. Plus the documentation your review process actually asks for.
no foundation-model training on your data. your data is stored in the united states (aws us-east-1, with encrypted backup copies in aws us-west-2); keeping model calls in the united states is a workspace setting. tenant isolation is enforced inside the database itself. On Enterprise there are two ways to deploy: a single-tenant deployment operated by Zentrr, with your data in Zentrr’s AWS; or BYOC, in your own AWS account.
security features
Built for teamswith real obligations.
Controls that protect your data and give your compliance officer the evidence they need.
Network isolation
availableThe database and the web application’s servers run on a private network with no direct access from the public internet.
Encryption
availableYour data is encrypted at rest (AES-256) in the database and in document storage, and in transit (TLS 1.2 or higher).
Single-tenant or BYOC deployment
enterpriseOn Enterprise there are two ways to deploy: a single-tenant deployment operated by Zentrr, with your data in Zentrr’s AWS; or BYOC, in your own AWS account.
Connect your AWS account (read-only)
availableOptional: connect your AWS account through one read-only role you create in it. We never receive AWS credentials, and you can revoke all access at any time. Read-only is enforced twice by default, by the role and again on every call, you scope it to the services your Specialists need, and every call is logged. Device control (IoT actuation) is the one scope that can write: off unless you opt in, and every command then takes a single-use human approval.
Multi-tenant RBAC
availableThree workspace roles (Workspace Admin · Team Lead · Member). Tenant isolation is enforced inside the database itself, alongside application-level scoping.
Audit logging
availableChanges to members, roles, workspace policies and security settings are recorded in your workspace’s audit trail, and administrative actions on our infrastructure are logged, each with the user, time, and action.
Compliance posture monitoring
availableIn-product assessment tools that read your AWS account's security posture (through the same read-only access) and check it against HIPAA, SOC 2, GDPR, NIST 800-53, ISO 27001 and CIS control families. Results are exportable for your auditor to review — they are not audit attestations.
Multi-factor sign-in
availableMulti-factor sign-in that each workspace’s admin can require of every member. OAuth/OIDC sign-in (Google, SSO) is supported.
AWS Bedrock only
availableAll AI inference through AWS Bedrock. By default, no data sent to third-party AI providers. Optional models that share data with their provider (a small set of Anthropic models served via AWS Bedrock) require a per-agent opt-in. Keeping model calls in the United States is a workspace setting.
posture checks on your aws account
Check your ownAWS environment.
Once you connect your AWS account, the in-product assessment checks its configuration against HIPAA, SOC 2, GDPR, NIST 800-53, ISO 27001 and CIS control families. The results describe your environment. They are not certifications we hold, and they are not audit attestations.
compliance documentation
Documentationyour CCO can take home.
Everything your compliance review actually asks for — ready to share with your security team, privacy officer, or auditor.
Security overview
PDF summary of the security architecture, data flow, and access controls — ready to share with your CCO.
Architecture diagram
AWS Bedrock data flow showing tenant isolation, inference boundaries, and where customer data actually lives.
Data processing agreement (DPA)
Template DPA aligned with GDPR Article 28 and covering sub-processor disclosure, data residency, and breach notification.
Vendor security questionnaire
Pre-filled responses to CAIQ-lite, SIG, and custom questionnaires. Turnaround measured in days, not weeks.
Compliance posture reports
In-product assessment of your environment against HIPAA, SOC 2, GDPR, NIST 800-53, ISO 27001 and CIS control families. Exportable for your auditor to review. Not an audit attestation.
Audit trail exports
Every chat, citation, and approval logged with user, timestamp, and context. Chat turns are recorded as fingerprints, not words. Email a Specialist sends with its email and calendar tools, and email an app sends, is logged with its recipient count and domains, never the addresses. What our support staff open through a support window you grant is logged too. Exportable as CSV for regulators, courts, or internal review.
Detailed security documentation is available to customers and, on request, to prospects under NDA.
A SOC 2 Type II audit is planned; the report will be available under NDA once issued. Until it completes, the in-product Platform controls view shows how our own production environment scored against the SOC 2 control families in our latest compliance scan — an evaluation tool, not an audit attestation.
Request compliance documentationdata handling
Where your dataactually goes.
- All LLM calls route through AWS Bedrock — by default, no data sent to third-party AI providers (a small set of Anthropic models served via AWS Bedrock share data with their provider and require a per-agent opt-in)
- Encrypted at rest and in transit (TLS 1.2 or higher)
- Tenant isolation enforced inside the database itself, alongside application-level scoping
- Changes to members, roles, policies and security settings recorded in your audit trail
- Hosted on Amazon Web Services in the United States; keeping model calls in the United States is a workspace setting
- On Enterprise there are two ways to deploy: a single-tenant deployment operated by Zentrr, with your data in Zentrr’s AWS; or BYOC, in your own AWS account.
the security review call
Bring yourcompliance officer.
Send them the documentation, or bring them to a security review call. We answer the questions your review process asks — on your timeline, not a six-month one.