COMPLIANCE FRAMEWORK

Compliance

Built for Regulated Industries

Organizations in highly regulated industries do not have the luxury of treating compliance as an afterthought. Regulatory requirements are not checkboxes to be ticked after the product is built; they are constraints that must shape the architecture from the first line of code.

Otonomii was designed from the ground up to meet the compliance requirements of financial services, healthcare, energy, government and insurance. Every deployment undergoes a compliance mapping exercise that identifies applicable regulations, standards and frameworks.

Controls are configured to meet or exceed those requirements. Compliance posture is continuously monitored, and customers receive proactive notifications when regulatory changes affect their configuration.

Industry Coverage

Financial Services

SEC, FINRA, MiFID II, Dodd-Frank, Basel III, SOX

Financial institutions face some of the most stringent regulatory requirements globally. Otonomii meets these through immutable audit trails, real-time transaction monitoring, model governance frameworks, explainable algorithmic decision paths and position-level data lineage that traces every output back to its inputs. Information barriers separate proprietary trading and technology licensing operations. Fund and licensing teams operate on independent systems with separate access controls. All personnel are subject to a Code of Ethics and strict personal trading policies in compliance with SEC Rule 204A-1. Personal securities transactions require pre-clearance and are monitored for conflicts of interest.

Flexible Deployment

Cloud Deployment

AWS Bedrock, GCP Vertex AI, Azure

Deploy on AWS, Google Cloud or Azure using native model hosting, encrypted data storage, private networking, key management and regulated workload support. Cloud deployments support VPC isolation, regional residency and multi-account or enterprise governance.

On-Premises Deployment

Air-gapped and customer controlled infrastructure

Containerized deployment via Kubernetes with support for OpenShift, Rancher and vanilla K8s. Production deployments support GPU inference nodes, redundant storage, 10GbE networking, offline license activation and manual update channels.

Hybrid Configuration

Cloud training, on-premises inference

Training and experimentation run in the cloud for elastic compute access, while inference and decision-making run on-premise where sensitive data resides. A secure synchronization layer keeps models and metadata consistent without exposing raw data.

Cloud Region Availability

RegionAWSGCPAzure

US Eastus-east-1us-east4East US

US Westus-west-2us-west1West US 2

EU Westeu-west-1europe-west1West Europe

EU Centraleu-central-1europe-west3Germany West Central

UKeu-west-2europe-west2UK South

Canadaca-central-1northamerica-northeast1Canada Central

Tokyoap-northeast-1asia-northeast1Japan East

Sydneyap-southeast-2australia-southeast1Australia East

Singaporeap-southeast-1asia-southeast1Southeast Asia

Mumbaiap-south-1asia-south1Central India

Sao Paulosa-east-1southamerica-east1Brazil South

Bahrain / UAEme-south-1me-central1UAE North

Safety-First Approach

Data protection at Otonomii operates end-to-end across ingestion, processing, storage, retrieval and deletion. At no point does data exist in an unprotected state. This is achieved through layered defenses that operate independently.

Encryption at Rest

All customer data is encrypted using AES-256. Encryption keys are managed through HSMs with automatic key rotation. Customer-managed keys are supported for customers requiring direct key custody.

Encryption in Transit

All data in transit is protected by TLS 1.3 with forward secrecy. Internal service-to-service communication uses mutual TLS with certificate rotation.

Access Controls

Role-based access control with principle of least privilege. MFA is required for all human access. Service accounts use short-lived tokens with automatic rotation.

Network Security

Production infrastructure operates in isolated VPCs with no direct internet ingress. API traffic enters through hardened gateways with rate limiting, DDoS protection and WAF rules.

Input Validation

Customer inputs are validated, sanitized and classified before processing. Injection attacks, prompt manipulation and exfiltration attempts are detected and blocked at the API layer.

Output Filtering

Model outputs pass through safety classifiers before delivery. PII leakage, policy violations or hallucination patterns are flagged, filtered or blocked depending on configuration.

Data Residency Deep-Dive

Data residency at Otonomii is not a marketing claim; it is an architecturally enforced guarantee. When a customer selects a data residency region, raw inputs, processed outputs, learned patterns and trained model artifacts are bound to that region.

Inputs

Customer submitted data is received by the regional API endpoint, validated and stored in the designated region. Requests arriving at non-designated endpoints are rejected, not redirected.

Outputs

All generated responses, decisions and predictions are computed and stored in the same region as the inputs that produced them. Output caches, logs and analytics are region-bound.

Patterns

Intermediate representations, embeddings, attention patterns and derived features remain in the designated region and are treated with equal or greater protection than raw data.

Model Artifacts

Fine-tuned models, adapter weights and learned parameters created from customer data are stored exclusively in the customer’s designated region and encrypted with customer-specific keys.

Data-at-Rest Protections

All data at rest is encrypted using AES-256-GCM with keys managed through HSM-backed cloud key management services. Customers may use customer-managed encryption keys. Deletion requests trigger cryptographic erasure.

Data-in-Transit Protections

All data in transit is encrypted using TLS 1.3. Certificate pinning is available, all inter-service communication uses mutual TLS and no data traverses the public internet between internal services.

Inference Residency

Inference residency controls where requests are processed and decisions are generated. Compute stays in the designated jurisdiction unless the customer explicitly configures approved multi-region inference.

Certification Details

SOC 2 Type II

Compliant

Security, Availability, Confidentiality, Processing Integrity

Evaluates design and operating effectiveness of controls over an extended period. Covers enterprise AI trust service criteria and is audited annually by an independent CPA firm.

Annual audit, continuous monitoring

ISO 27001

Compliant

Information Security Management System

Covers the full ISMS, including risk assessment, controls, internal audit, management review, production infrastructure, development environments, corporate IT, facilities and personnel security.

3-year certification cycle with annual surveillance audits

GDPR

Compliant

Data subject rights, DPA, SCCs

Implements rights of access, rectification, erasure, restriction, portability and objection. DPAs are executed with customers processing EU personal data.

Continuous compliance with annual DPIA reviews

CCPA / CPRA

Compliant

Consumer rights, opt-out, privacy disclosures

Supports consumer rights to know, delete, correct, opt out and limit use of sensitive personal information. Otonomii does not sell personal information.

Annual review aligned with regulatory updates

HIPAA

Ready

PHI handling, BAA, safeguards

Provides HIPAA ready environments with BAAs, encryption, unique user identification, audit controls, workforce training, access management, contingency planning and incident procedures.

Annual risk assessment and gap analysis

PCI DSS

Compliant

Payment card data handling

Maintains PCI DSS Level 1 compliance for customers processing payment card data. Payment data is tokenized at entry and never stored in cleartext.

Annual assessment with quarterly ASV scans

CSA STAR

Compliant

Cloud security and CCM controls

Validates cloud security posture against the Cloud Controls Matrix across application security, audit assurance, business continuity, data security, encryption, IAM, incident management and compliance.

Annual certification renewal

SEC Rule 17a-4

Compliant

Broker dealer records retention

Audit trail infrastructure supports WORM retention through append-only log storage with cryptographic integrity verification, indexing and searchable records.

Annual validation with continuous monitoring

Audit Process

Customers have the right to verify Otonomii’s compliance posture through multiple mechanisms. Transparency is foundational to trust and several pathways are available for customers to gain assurance.

Self-Service Audit Reports

SOC 2 reports, ISO certificates, penetration test summaries and CSA STAR questionnaires are available through the customer trust portal.

Customer-Initiated Audits

Enterprise customers may conduct audits of systems, processes and controls. Requests are scheduled within 30 business days with a dedicated audit liaison.

Third-Party Audit Reports

Annual penetration tests, red team exercises and supply chain assessments are commissioned from independent firms. Summaries are available under NDA.

Continuous Compliance Monitoring

Control effectiveness is tracked in real-time. Deviations trigger automated alerts and remediation workflows.

Regulatory Examination Support

Otonomii supports customer regulatory examinations with document production, technical explanations and direct engagement with examiners when needed.

Data Processing Agreement Summary

Otonomii’s Data Processing Agreement governs how customer personal data is processed when Otonomii acts as a data processor on behalf of the customer. The DPA is incorporated into the enterprise service agreement and complies with GDPR Article 28 requirements.

Processing Purpose

Customer personal data is processed solely for contracted services. No secondary use, no model training on customer data and no profiling beyond what the customer explicitly configures.

Sub-Processors

Approved sub-processors are maintained in a list. Customers are notified at least 30 days before new sub-processors are engaged and may object.

Data Deletion

Upon termination or request, personal data is deleted within 30 days. Backup copies are purged within 90 days. Cryptographic erasure is used where immediate physical deletion is not feasible.

International Transfers

Transfers outside the EEA are protected by Standard Contractual Clauses with documented Transfer Impact Assessments.

Security Measures

The DPA references Technical and Organizational Measures covering encryption, access controls, incident response, continuity and personnel security.

Breach Notification

Customers are notified of personal data breaches without undue delay and within 72 hours of Otonomii becoming aware of the breach.

Audit Rights

Customers have the right to audit DPA compliance through access to relevant information, systems and personnel.

The full Data Processing Agreement is available for review during the enterprise sales process. Customers may request a copy at any time by contacting their account representative.

Built for Regulated Industries

Industry Coverage

Financial Services

SEC, FINRA, MiFID II, Dodd-Frank, Basel III, SOX

Flexible Deployment

Cloud Deployment

AWS Bedrock, GCP Vertex AI, Azure

On-Premises Deployment

Air-gapped and customer controlled infrastructure

Hybrid Configuration

Cloud training, on-premises inference

Cloud Region Availability

RegionAWSGCPAzure

US Eastus-east-1us-east4East US

US Westus-west-2us-west1West US 2

EU Westeu-west-1europe-west1West Europe

EU Centraleu-central-1europe-west3Germany West Central

UKeu-west-2europe-west2UK South

Canadaca-central-1northamerica-northeast1Canada Central

Tokyoap-northeast-1asia-northeast1Japan East

Sydneyap-southeast-2australia-southeast1Australia East

Singaporeap-southeast-1asia-southeast1Southeast Asia

Mumbaiap-south-1asia-south1Central India

Sao Paulosa-east-1southamerica-east1Brazil South

Bahrain / UAEme-south-1me-central1UAE North

Safety-First Approach

Encryption at Rest

All customer data is encrypted using AES-256. Encryption keys are managed through HSMs with automatic key rotation. Customer-managed keys are supported for customers requiring direct key custody.

Encryption in Transit

All data in transit is protected by TLS 1.3 with forward secrecy. Internal service-to-service communication uses mutual TLS with certificate rotation.

Access Controls

Role-based access control with principle of least privilege. MFA is required for all human access. Service accounts use short-lived tokens with automatic rotation.

Network Security

Production infrastructure operates in isolated VPCs with no direct internet ingress. API traffic enters through hardened gateways with rate limiting, DDoS protection and WAF rules.

Input Validation

Customer inputs are validated, sanitized and classified before processing. Injection attacks, prompt manipulation and exfiltration attempts are detected and blocked at the API layer.

Output Filtering

Model outputs pass through safety classifiers before delivery. PII leakage, policy violations or hallucination patterns are flagged, filtered or blocked depending on configuration.

Data Residency Deep-Dive

Inputs

Customer submitted data is received by the regional API endpoint, validated and stored in the designated region. Requests arriving at non-designated endpoints are rejected, not redirected.

Outputs

All generated responses, decisions and predictions are computed and stored in the same region as the inputs that produced them. Output caches, logs and analytics are region-bound.

Patterns

Intermediate representations, embeddings, attention patterns and derived features remain in the designated region and are treated with equal or greater protection than raw data.

Model Artifacts

Fine-tuned models, adapter weights and learned parameters created from customer data are stored exclusively in the customer’s designated region and encrypted with customer-specific keys.

Data-at-Rest Protections

Data-in-Transit Protections

All data in transit is encrypted using TLS 1.3. Certificate pinning is available, all inter-service communication uses mutual TLS and no data traverses the public internet between internal services.

Inference Residency

Certification Details

SOC 2 Type II

Compliant

Security, Availability, Confidentiality, Processing Integrity

Evaluates design and operating effectiveness of controls over an extended period. Covers enterprise AI trust service criteria and is audited annually by an independent CPA firm.

Annual audit, continuous monitoring

ISO 27001

Compliant

Information Security Management System

Covers the full ISMS, including risk assessment, controls, internal audit, management review, production infrastructure, development environments, corporate IT, facilities and personnel security.

3-year certification cycle with annual surveillance audits

GDPR

Compliant

Data subject rights, DPA, SCCs

Implements rights of access, rectification, erasure, restriction, portability and objection. DPAs are executed with customers processing EU personal data.

Continuous compliance with annual DPIA reviews

CCPA / CPRA

Compliant

Consumer rights, opt-out, privacy disclosures

Supports consumer rights to know, delete, correct, opt out and limit use of sensitive personal information. Otonomii does not sell personal information.

Annual review aligned with regulatory updates

HIPAA

Ready

PHI handling, BAA, safeguards

Provides HIPAA ready environments with BAAs, encryption, unique user identification, audit controls, workforce training, access management, contingency planning and incident procedures.

Annual risk assessment and gap analysis

PCI DSS

Compliant

Payment card data handling

Maintains PCI DSS Level 1 compliance for customers processing payment card data. Payment data is tokenized at entry and never stored in cleartext.

Annual assessment with quarterly ASV scans

CSA STAR

Compliant

Cloud security and CCM controls

Annual certification renewal

SEC Rule 17a-4

Compliant

Broker dealer records retention

Audit trail infrastructure supports WORM retention through append-only log storage with cryptographic integrity verification, indexing and searchable records.

Annual validation with continuous monitoring

Audit Process

Self-Service Audit Reports

SOC 2 reports, ISO certificates, penetration test summaries and CSA STAR questionnaires are available through the customer trust portal.

Customer-Initiated Audits

Enterprise customers may conduct audits of systems, processes and controls. Requests are scheduled within 30 business days with a dedicated audit liaison.

Third-Party Audit Reports

Annual penetration tests, red team exercises and supply chain assessments are commissioned from independent firms. Summaries are available under NDA.

Continuous Compliance Monitoring

Control effectiveness is tracked in real-time. Deviations trigger automated alerts and remediation workflows.

Regulatory Examination Support

Otonomii supports customer regulatory examinations with document production, technical explanations and direct engagement with examiners when needed.

Data Processing Agreement Summary

Processing Purpose

Customer personal data is processed solely for contracted services. No secondary use, no model training on customer data and no profiling beyond what the customer explicitly configures.

Sub-Processors

Approved sub-processors are maintained in a list. Customers are notified at least 30 days before new sub-processors are engaged and may object.

Data Deletion

Upon termination or request, personal data is deleted within 30 days. Backup copies are purged within 90 days. Cryptographic erasure is used where immediate physical deletion is not feasible.

International Transfers

Transfers outside the EEA are protected by Standard Contractual Clauses with documented Transfer Impact Assessments.

Security Measures

The DPA references Technical and Organizational Measures covering encryption, access controls, incident response, continuity and personnel security.

Breach Notification

Customers are notified of personal data breaches without undue delay and within 72 hours of Otonomii becoming aware of the breach.

Audit Rights

Customers have the right to audit DPA compliance through access to relevant information, systems and personnel.

The full Data Processing Agreement is available for review during the enterprise sales process. Customers may request a copy at any time by contacting their account representative.

Autonomous Intelligence For The Next Era of Finance

Company

About Otonomii

Company Overview

Community

Ecosystem

Contact

CEO

Platform

Platform Overview

Enterprise Infrastructure

Security Architecture

Trust & Governance

Solutions

Autonomous Agents

Agentic System

Process Intelligence

Operational Insights

Cognitive Intelligence

AI Decision Engine

Reserach

Architecture Guide

Cognitive Model

Research Archive

Research Center

Investors

Investor Relation

Investor Portal

Legal

Personal Terms

Platform Terms

Enterprise Terms

Enterprise Policies

Data and Governance

Compliance

Regulatory Standards

Compliance Framework

Disclosure Guidlines

Transparency Policy

Acceptable Use

Usage Policy

TOP

Autonomous Intelligence For The Next Era of Finance

Company

Platform

Solutions

Reserach

Investors

Legal

Compliance

TOP

Autonomous Intelligence For The Next Era of Finance

Company

About Otonomii

Company Overview

Community

Ecosystem

Contact

CEO

Platform

Platform Overview

Enterprise Infrastructure

Security Architecture

Trust & Governance

Solutions

Autonomous Agents

Agentic System

Process Intelligence

Operational Insights

Cognitive Intelligence

AI Decision Engine

Reserach

Architecture Guide

Cognitive Model

Research Archive

Research Center

Investors

Explained

Investor Portal

Legal

Personal Terms

Platform Terms

Enterprise Terms

Enterprise Policies

Data and Governance

Compliance

Regulatory Standards

Compliance Framework

Disclosure Guidlines

Transparency Policy

Acceptable Use

Usage Policy

TOP