Security at Keiji AI
Security at Keiji AI
The security principles, controls, certifications, and policies that protect customer data and the TrialMind platform.
Security principles
Defense in depth
Multiple layers of security controls to protect against various threat vectors
Least-privilege access
Every identity verified, and access scoped to what each role needs
Continuous monitoring
Logging and alerting on production systems, with a documented incident response process
Data protection
Encryption at rest and in transit, with strict data handling procedures
Security controls
- Infrastructure Security
- Hosted on Amazon Web Services (AWS) cloud infrastructure
- Network segmentation and firewall protection
- Regular security assessments
- Automated vulnerability scanning and remediation
- Secure configuration management
- Data Security
- Encryption of stored data using AES-256 (Advanced Encryption Standard)
- Encryption of data in transit using TLS (Transport Layer Security) 1.2 or later
- Secure data backup and recovery procedures
- Data retention and disposal policies
- Access Control
- Multi-factor authentication (MFA) required
- Role-based access control (RBAC)
- Principle of least privilege
- Regular access reviews and deprovisioning
- Incident Response
- Documented incident response procedures
- Defined roles and escalation paths
- Customer notification of security incidents
Certifications and audits
Reports and certificates are available under a non-disclosure agreement (NDA).
SOC 2 Type I & Type II
Audited. Service Organization Control 2 (SOC 2): independent attestation of controls for security, availability, and confidentiality
ISO 27001
Certified. International standard for an information security management system (ISMS); our ISMS is certified
HIPAA
Compliant. Health Insurance Portability and Accountability Act (HIPAA) Security Rule safeguards, with business associate agreements (BAAs) available
GxP
Qualified. GxP (good practice regulations such as good clinical practice): Data Science Assistant v1.0.0 qualified as a GxP computerized system using the GAMP 5 (Good Automated Manufacturing Practice) risk-based approach, with controls for 21 CFR Part 11 (FDA rules for electronic records and signatures) and EU Annex 11 (European rules for computerized systems)
Security policies
- Information Security Policy
- Comprehensive framework for protecting information assets
- Data Classification Policy
- Guidelines for classifying and handling different types of data
- Incident Response Policy
- Procedures for detecting, responding to, and recovering from security incidents
- Access Control Policy
- Standards for user access management and authentication
- Vendor Security Policy
- Requirements for third-party vendor security assessments
- Business Continuity Policy
- Plans for maintaining operations during disruptions
Monitoring and staff training
- Monitoring
- Centralized logging of production systems
- Alerting on security-relevant events
- Vulnerability scanning of infrastructure and dependencies
- Security Awareness
- Security training for all employees
- Security incident reporting procedures
- Independent third-party audits (SOC 2, ISO 27001)
Report a security concern
To report a vulnerability or raise a concern, contact our security team directly.