Zero-Training & Data Custody Guarantee
Enterprise customers retain 100% intellectual property ownership over all ingested documents, code repositories, and generated conversation logs:- No Model Pre-Training: Your proprietary documentation, code ASTs, and user inquiries are never used by MITHUNAI or upstream LLM providers to train or improve foundation models.
- Provider Zero Data Retention (ZDR): Commercial LLM routing uses enterprise agreements that legally enforce Zero Data Retention (ZDR)—upstream providers do not cache or store query tokens after completing streaming inference.
- Private Embeddings Storage: All vector embeddings are stored inside your organization’s isolated PostgreSQL partition and deleted permanently upon collection removal.
Regulatory Frameworks
SOC 2 Type II
MITHUNAI is audited annually by independent AICPA-accredited auditors. Our SOC 2 Type II report verifies the operational effectiveness of controls across:- Security: Network firewalls, vulnerability scanning, employee background checks, and automated CI/CD security linters.
- Availability: 99.9% uptime SLAs with multi-AZ failover and automated disaster recovery runbooks.
- Confidentiality: Hard PostgreSQL multitenancy isolation where cross-tenant queries fail closed.
HIPAA (Health Insurance Portability and Accountability Act)
For healthcare and life sciences organizations handling Protected Health Information (PHI):- Business Associate Agreements (BAAs): MITHUNAI signs BAAs with enterprise customers deploying in dedicated or sovereign cloud tiers.
- Automated PII/PHI Redaction: Ingestion filters redact medical record numbers, social security numbers, and patient names prior to vector embedding.
- Dedicated Key Management: Customer-Managed Encryption Keys (CMEK) via AWS KMS, GCP KMS, or HashiCorp Vault.
GDPR & Global Data Privacy
- Right to Erasure (Article 17): Deleting a document or collection permanently purges all raw text, chunks, and vector embeddings across all storage tiers within seconds.
- Data Residency: Choose between US, EU (Frankfurt / Dublin), and APAC data regions to satisfy national data sovereignty mandates.
- Data Processing Addendum (DPA): Standard contractual clauses (SCCs) are incorporated into all enterprise service agreements.