Compliance and the CISO posture

We map governing frameworks across three main regions: GDPR, DORA, and the EU AI Act for Europe; SOC 2, GLBA, SOX, attorney-client privilege, and data residency for the United States and global market; and GDPR-aligned regimes including LGPD for Latin America. These frameworks consolidate the vertical requirements detailed across our Industries pages. Agent sandboxing and access control are defined as explicit technical controls that you can review and verify directly.

Diagram of regional compliance frameworks converging into agent sandboxing and access control

Governing frameworks per region

Each region operates under distinct regulatory requirements. Below are the governing frameworks we address and the in-network architecture engineered to satisfy them.

United States & global market

Primary edition: /en/ (English).

SOC 2 control posture

The Trust Services Criteria that enterprise buyers and their auditors require. In-network deployment delivers the security, availability, processing integrity, confidentiality, and privacy controls attested in SOC 2 reports. You maintain direct ownership of these controls without the split boundaries of a shared-responsibility model.
GLBA safeguards

The Safeguards Rule governing nonpublic customer financial information. Access to, storage of, and disposal of personal financial data remain strictly inside your network, isolated from multi-tenant cloud environments.
SOX internal controls over financial reporting

Internal controls and governance-reporting obligations for public companies. Regulators, auditors, and counterparties can verify data residency and legal privilege directly inside the network you operate.

European Union & Central and Eastern Europe

Primary edition: /pl/ (Polski).

GDPR

The data protection regime governing every European Union jurisdiction. Operating inside your network keeps processing, data retention, and cross-border transfers inside your chosen jurisdiction rather than on third-party cloud regions.
DORA (operational resilience)

The Digital Operational Resilience Act governs financial ICT systems and third-party risk. Dedicated infrastructure inside your network, paired with local telemetry, gives you direct operational control. Processing and telemetry stay inside your network by default, and any external connection is an explicit configuration your team makes and can revoke.
EU AI Act (risk framing)

The EU AI Act establishes risk-based obligations for systems in legal, finance, and technology, covering technical documentation through ongoing evaluation. We structure each implementation around the specific risk tier of your use case.

Latin America

Primary edition: /es/ (Español).

GDPR-influenced regimes

Data protection laws across Latin America increasingly follow European standards. Operating inside your network keeps processing and data storage in your chosen jurisdiction, which is what local residency and data-processing regimes examine.
LGPD-readiness (Brazil)

Brazil's Lei Geral de Proteção de Dados (LGPD) applies whenever systems process data of Brazilian individuals. In-network deployment keeps data residency and technical controls inside your network, supporting your LGPD posture from day one.

Control scope

Agent sandboxing and access control

Regulatory frameworks establish the rules, but security depends on technical architecture. Our control model gives CISOs an auditable foundation: AI agents run exclusively on private infrastructure inside your network. Inference calls and tool actions remain strictly sandboxed. Access permissions strictly enforce regional data residency requirements.

In-network by default. By default, nothing the system processes leaves your network: model calls, tool actions, and telemetry all stay inside. Where a deployment chooses to connect an external service, that connection is an explicit configuration your team makes and can revoke - and the gateway records every call it carries.
Sandboxed inference and tool actions. All model calls and tool executions operate strictly inside your network. Tool actions are bounded by isolated runtime environments, preventing agents from exceeding their authorized permissions.
Access scoped to regional requirements. Access is strictly aligned with the data residency and security controls of each regional framework. Least-privilege defaults are enforced at the network level rather than through generic policy labels.

Where each request travels

By default, every request stays inside your network: it travels from your workstation to the inferencer and back, and the boundary stays closed. That is the right-hand path. The left-hand path is the exception a deployment can configure: the request crosses the network boundary to a public cloud region and returns, and every crossing is an explicit configuration your team makes and can revoke.

Diagram of two request paths. The left path crosses the network boundary to a public cloud region and back, with the outbound crossing marked by a drafting cross. The right path stays inside an unbroken network boundary, traveling from a workstation to a server inside the network.

Take it forward

The frameworks above consolidate compliance requirements across our core industry verticals. In the Building and Validation stage, we prove these sandboxing and access controls on real hardware before you commit capital. Explore industry-specific details, review technical validation, or schedule a consultation below.