Colour theme
Signature
Professional
Dark
Expressive
Security & trust
If you run a hospital or hold student records, this is the first thing you need from a vendor and the last thing most vendor sites answer honestly. Here is our actual position.
Where we actually stand on certification
GrayMatter Technologies does not hold ISO 27001, SOC 2, or any equivalent certification today. We are a young company, and no company of our age holds them honestly. We build to the practices those standards describe, and we will pursue formal certification when an engagement requires it and we can complete it properly. If certification is a hard gate in your procurement process right now, we will not pass it, and we would rather you knew that here than three meetings in.
How we build
These describe practice, not compliance. Where a statement needs to become a contractual commitment, it goes in the agreement rather than staying on a web page.
01
We do not train shared or public models on your information, and your data is not pooled with another organisation's to improve a general model. Where a third-party model provider is used in an engagement, it is named in the agreement and configured so your content is not retained for training.
02
Access is scoped to the role that needs it and no wider, and access to identifying data is recorded. We would rather answer a question on aggregated or de-identified data than on a full record, and we will design the engagement that way where it is possible.
03
Standard transport encryption for data in motion and encryption at rest for stored data, using the managed services of the underlying cloud rather than anything we invented ourselves.
04
Recommendations carry their reasoning and their inputs. Approvals are recorded against the actions that followed them. If someone asks six months later why a decision was made, the trail answers rather than a person's memory.
05
This is a security property as much as a governance one. Automated execution without a recorded human approval is not a feature we are working toward.
06
Deployment can run in your cloud account or ours, in the region your compliance team requires. We would rather fit your constraint than ask you to accept ours.
07
We ask for the narrowest data set that can answer the question, and retention is set in the agreement rather than by default. Deletion on request is part of the terms, not a favour.
08
Export in open formats, at any time, without asking us. Exit terms are agreed before work starts. A vendor that makes leaving difficult has told you something about itself.
Infrastructure
We build on established cloud and model providers rather than running our own. Which providers are used in your engagement is named in the agreement, along with what data reaches them and under what terms.
What we ask of you
Security is not something a vendor does to a customer. These are the parts we cannot do alone.
If a question can be answered on de-identified or aggregated data, ask us to do it that way. We will agree, and it reduces risk for both of us.
Our governance model assumes someone is accountable for each class of decision. If nobody is named, the recorded trail loses most of its value.
Residency requirements, internal policies, sector rules. These are much cheaper to design around at the start than to retrofit.
Questions your security team needs answered before a call? Send them and we will answer in writing
Start here
A sentence about what is slow, manual or missing is enough. We come back with a view on the fastest useful thing to put in front of you, and an honest answer on whether we are the right people to build it.