Skip to main content

Your Data, Protected at Every Step

BlueEye works inside your firm in a consulting capacity. The AI practice platform we deploy holds the independent certifications below. We name it in our engagement briefing so your risk team can verify every one of them directly.

SOC 2 Type II

Held by our
practice platform

ISO/IEC 27001:2022

Held by our platform,
valid to June 2028

GDPR

Platform data processing
addendum for EU and UK data

HIPAA-aligned

Platform safeguards.
No health data in scope

Security Framework

Who holds what

BlueEye is a consulting firm, not a software vendor, so the platform certifications belong to the platform. BlueEye carries its own professional liability (errors and omissions) and general liability coverage, with certificates available on request.

SOC 2 Type II, held by our platform

The AI practice platform we deploy is independently audited against the SOC 2 Trust Services Criteria for security, availability, confidentiality, processing integrity and privacy.

  • Audit period October 2024 to September 2025
  • Report dated January 2026, shared under NDA
  • Annual re-audit

ISO/IEC 27001:2022, held by our platform

The platform's information security management system is certified to ISO/IEC 27001:2022.

  • Registered June 2025
  • Certificate valid to June 2028
  • Annual surveillance audits

GDPR · HIPAA-aligned, at the platform

The platform offers a data processing addendum for EU and UK personal data and maintains HIPAA-aligned safeguards.

  • GDPR-compliant data processing and subject rights
  • HIPAA-aligned safeguards for sensitive information
  • No consumer or account-level financial data in scope

Your Data Stays Yours

Client and conversation data belong to your firm. They are never used to train AI models.

  • No model training on your data, ever
  • AES-256 encryption at rest, TLS 1.2+ in transit
  • Conversation data confined to your engagement
Data Protection

Security at Every Layer

We apply a layered approach to security across our infrastructure, data handling, and application design.

Infrastructure & Access

  • Encryption at Rest & in Transit
    Data encrypted at rest and in transit using industry-standard encryption protocols through our infrastructure providers.
  • Access Control & Authentication
    Multi-factor authentication enforced. Role-based access controls (RBAC) with least-privilege principle. Regular access reviews.
  • Continuous Monitoring
    24/7 automated threat detection. Security Information and Event Management (SIEM) with Datadog. Incident response team on call.
  • Disaster Recovery
    Automated daily backups with geographic redundancy. RTO: 4 hours. RPO: 1 hour. Quarterly disaster recovery tests.

Design & Governance

  • Security & Privacy by Design
    Security review in all development phases. Threat modeling for new features. Privacy impact assessments before deployment.
  • Incident Response
    Documented incident response plan. Trained response team. Initial notification within 24 hours of discovery.
  • Vulnerability Management
    Regular penetration testing. Automated vulnerability scanning. Third-party security assessments annually.
  • Employee Training
    Annual security awareness training for all staff. Regular phishing simulations. Onboarding security certifications.

Request a detailed security assessment: We provide comprehensive documentation and are happy to discuss your specific security requirements with your team.

Infrastructure

Trusted AI Infrastructure

Built on trusted platforms from leading cloud and AI providers.

Azure OpenAI

Foundation models hosted on Microsoft's cloud infrastructure with audit logging and access controls.

AWS Bedrock (Anthropic Claude)

Managed service providing access to advanced models with security controls and privacy protections.

Supabase PostgreSQL

Open-source PostgreSQL with built-in encryption and automated backups on secure cloud infrastructure.

PropelAuth

Modern authentication platform with passwordless sign-in, SSO, and comprehensive audit trails.

Datadog Monitoring

Real-time system monitoring, log aggregation, and security alerting across all infrastructure components.

MongoDB (Optional)

Flexible document database with field-level encryption, role-based access, and automated compliance.

Privacy & Compliance

Regulatory Compliance

How the platform we deploy supports your firm's obligations under the frameworks reviewers ask about most.

GDPR

Designed to support GDPR requirements including data access, erasure, and portability. Data processing agreements available upon request.

HIPAA

The platform maintains HIPAA-aligned safeguards. Our financial services engagements involve no health information, so HIPAA is rarely in scope.

CCPA/CPRA

Designed to support California Consumer Privacy Act requirements including data access, deletion, and opt-out requests.

Financial Services

Designed with financial services regulatory considerations in mind. Built to support your organization's compliance requirements.

Data Residency

Data storage location controls. Support for EU data residency. Geographic redundancy without cross-border transfer.

Compliance Audits

Annual independent audits. Compliance documentation available. Transparent security and privacy reporting.

Ready to get started?

Let’s talk about how this clears your security and compliance review.

Book a Demo