Security & Governance
Evidence, not assurances.
Every ANULUM system ships with a defined control set and a repeatable evaluation pack. You do not have to believe the system works — you can inspect the record.
Controls in every paid deployment
- Full-disk encryption on every node
- TLS on all user and API paths
- Local identity or integration with your OIDC/SAML directory
- Role-based access control — matter, mandate, or department separation
- Append-only audit logs of prompts, answers, and administrative actions
- Source hashing for every ingested document
- Model and package inventory (SBOM) — you know exactly what runs
- Backups with tested, demonstrated restore
- Defined security-update policy with approved maintenance windows
- Administrative separation — support access does not mean data access
- No silent external API calls — the network path is inspectable
Regulated deployments add SIEM export, change-control records for model and index updates, evaluation packs before any model promotion, incident-response procedures, and a vendor and subcontractor register.
The evaluation pack: tested before you rely on it
Before a system is handed over — and before any model update is promoted — it runs a client-specific evaluation:
Groundedness
Answers must cite retrieved sources from your archive. Uncited assertions fail the gate.
Refusal behaviour
When the archive does not support an answer, the system must say so instead of guessing.
Prompt-injection resistance
Adversarial documents and instructions are planted; the system must not follow them.
Access control
Users must not retrieve material outside their role — verified by test, not by configuration review alone.
Confidentiality challenges
Attempts to extract restricted content across roles and sessions are exercised and logged.
Latency and concurrency
Measured on your hardware under recorded load — so expectations are set by evidence.
How answers stay accountable
Human judgement stays in charge: ANULUM systems support your professionals with grounded material. They do not make legal, financial, or medical decisions.
How we talk about evidence
We label our own claims by their strength, and we hold our marketing to the same ladder:
- Local functional evidence The behaviour was demonstrated on our reference systems.
- Client acceptance evidence The behaviour passed your acceptance tests, on your material.
- Production performance evidence The behaviour was measured on your production hardware under recorded load — the only tier we quote performance from.