SOC 2 Type II
✓ In placeSecurity, availability and confidentiality.
GOAL: shorten security review from weeks to days · AUDIENCE: CISO, DPO, procurement · CTA: Request security documentation (primary on this page). Formal, specific, verifiable register.
TRUST CENTER · UPDATED SEP 24, 2026
Trust, documented.
Every claim on this page links to a document, a control or a log. If something is missing, tell us.
- DATA LOCATION
- EU by default
- Frankfurt primary, Stockholm backup.
- MODEL TRAINING
- Off by default
- On every plan. Opt-in per workspace.
- RETENTION
- You decide
- 0 days to 7 years. Purge within 30 days.
- ENCRYPTION
- AES-256 · TLS 1.3
- Customer-managed keys on Enterprise.
Certifications & frameworks
Placeholder certifications for a fictional company. Report periods are illustrative.
ISO/IEC 27001:2022
✓ In placeInformation security management system.
ISO/IEC 42001:2023
◔ In progressAI management system.
GDPR
✓ In placeEU data protection. DPA with SCCs where needed.
EU AI Act
✓ In placeTransparency obligations under Art. 50.
CSA STAR Level 1
✓ In placeCloud security self-assessment.
Where your data goes
One request, end to end. Every hop stays inside the EU region you choose. Select a step to see what is stored and for how long.
- STORED
- Encrypted workspace data
- RETENTION
- Your retention setting (default 30 days)
- WHO CAN ACCESS
- Your admins; Cairn support only with your time-boxed grant
Controls you can check yourself
These are the actual workspace settings, shown here as a preview. Admins change them in the console; every change is written to the audit log.
WORKSPACE · DATA CONTROLSPREVIEW
Conversations in this workspace are kept for 30 days, then permanently deleted. They are never used to train or improve any model.
Export all data
Delete workspace
Subprocessors
| Entity | Purpose | Location | Customer data |
|---|---|---|---|
| Nordvolt Cloud GmbH | Hosting and compute | Germany | Yes, encrypted |
| Fjord Storage AB | Backup storage | Sweden | Yes, encrypted |
| Postwise Ltd. | Transactional email | Ireland | Email address only |
| Ledgerline Inc. | Billing and invoicing | United States (SCCs) | Billing contact only |
| Helpdeck Oy | Support tickets | Finland | Only what you send us |
| Signalhaus GmbH | Error monitoring | Germany | No content, metadata only |
Fictional entities. Changes announced 30 days in advance · Subscribe to changes
Documents
LEGALPUBLIC
Data Processing Agreement
GDPR Art. 28, pre-signed. Includes SCCs and TOMs.
Download PDF · 18 pages
SECURITYBY EMAIL
Security whitepaper
Architecture, encryption, access control and incident response.
Request by email →
AUDITNDA · CLICK-THROUGH
SOC 2 Type II report
Independent auditor’s report, Apr 2025 – Mar 2026.
Request under NDA →
AUDITNDA · CLICK-THROUGH
Penetration test summary
Third-party test, Oct 2025, with remediation status.
Request under NDA →
AIPUBLIC
Model cards
Intended use, limitations and evaluations for each model.
Read Summit 2.1 →
POLICYPUBLIC
Acceptable use policy
What you may and may not do with Cairn.
Read online →
EU AI ACT · TRANSPARENCY
How we meet Article 50
Placeholder summary. Not legal advice; your obligations depend on how you deploy Cairn.
- AI interaction disclosure. Every assistant and site widget says it is an AI before the first reply.
- Synthetic content marking. Generated images carry a visible label and C2PA Content Credentials.
- Model documentation. Model cards list intended use, limits and evaluations. Read Summit 2.1’s.
- Human oversight. Agents pause for approval before any external action.
90-day uptime
Full status page →Assistant99.98%
Agents99.95%
API99.99%
Console99.97%
Jun 26, 2026
■ operational ■ degraded ■ outage · illustrative
Today
Found a vulnerability?
Email security@cairn.example or use our PGP key. We acknowledge within 24 hours, never pursue good-faith research, and pay bounties from $500 to $25,000.
/.well-known/security.txt
✓ Request received
Check your inbox, there.
Public documents are on their way now. NDA-covered reports follow within one business day, after we verify your company domain. A person on our security team reads every request.
Want a security walkthrough call instead? →