Trust and security
The security questionnaire, answered before you send it.
Ayion Meru is pre-launch. This page says how the evidence ledger stays independent of the agents it records, what we store and what we refuse to store, where the keys live, which frameworks an evidence pack maps to, and what we have not built yet.
We hold no certifications. The section headed “What we do not have yet” names each one we do not hold, and it sits in the middle of this page rather than at the foot of it.
The independence rule
Independent by construction, not by promise.
Ayion sells the agents and the proof. That is a conflict of interest unless the proof is built so the agents cannot reach it, so it is built that way and the constraint is written down.
The independence rule
Assure records what any agent did, including agents from other vendors, and Run cannot alter the ledger. Keys are customer-held and records are verifiable by a third party without Ayion. Assure can be bought without Run. This is what lets one company offer both without asking auditors to trust the doer’s own record.
A left-to-right diagram. On the left, a box labelled Doers holds two items: Meru Run agents, and third-party agents from Microsoft, Salesforce or a customer’s own build. Arrows from both, labelled "actions captured", run to a cylinder on the right: the Assure evidence ledger, append-only and hash-chained. A separate box, customer-held keys, feeds into the same ledger from below. One arrow leaves the ledger, labelled "verify without Ayion", and reaches a box holding auditor, regulator and insurer. No arrow runs from either doer into the ledger directly.
-
Run writes nothing to the ledger
Capture writes the record, from the same path whether the agent is one of ours or one of Microsoft’s. There is no privileged write for Ayion’s own agents, because there is no privileged write at all.
-
The keys are yours
Records are sealed with keys you hold. Revoke them and we lose our own read as well, which is the only version of that promise worth anything.
-
A third party can verify without us
The ledger is append-only and hash-chained per tenant. An auditor recomputes the chain from an export, with our software nowhere in the loop.
-
Assure can be bought without Run
It is a product on its own, priced on its own, and it is the only arrangement under which asking an auditor to trust it is reasonable.
Data handling
References and hashes. Not your business data.
The ledger is built to be useful to an auditor and boring to an attacker. It holds enough to prove an action happened as approved, and as little as possible of what the action was about.
How capture and the ledger are built-
What the ledger stores
Identity, action type and target reference, a hash of the parameters, the policy decision and blueprint version, the approval and its bound hash, the execution result and cost, the observed change, the reconciliation status, and the record and chain hashes.
-
What it never stores
Your records. Parameters are redacted to hashes, business objects are held by reference, and the ledger cannot reconstruct an invoice, a ticket or a patient note from what it keeps.
-
Keys
Customer-held, per tenant. They seal the records and the exports. We cannot read a tenant’s ledger without them, and the moment you revoke them, neither can anyone else.
-
Retention
Set per class rather than as one number for the whole tenant, because an evidence record has to outlive the agent that made it while raw telemetry does not need to.
-
Residency
Regional residency options are planned. We are not naming a region on this page before it is live, because a region on a trust page is a commitment rather than a hope.
-
Deployment
A managed service with tenant isolation at launch. Private deployment inside your own cloud is on the roadmap and is not available today.
A tree. At the top, a single node reading "evidence record". Eight branches hang beneath it, each a labelled box: identity, holding the agent, the principal and the vendor; action, holding the type, the target and a parameter hash; policy, holding the blueprint version and the decision; approval, holding the approver and the bound hash; execution, holding the result, the retries and the cost; observation, holding the change seen in the system of record; reconciliation, holding the status and any corrections; and integrity, holding the record hash and the chain hash.
Redaction happens at capture, not at export. A parameter that never entered the ledger cannot be leaked out of it, subpoenaed out of it, or restored by us on request.
Evidence packs
Mapped to the frameworks. Certified against none.
An evidence pack assembles, from the ledger, what a framework asks a deployer of AI agents to be able to show. The mapping is our reading of the framework. It is not the framework’s endorsement of us, and no auditor has yet been given an Ayion pack, so nobody has accepted one.
-
SOX and ICFR
The pack carries the control descriptions, the full population of agent actions in scope for the period, the approvals sampled against them, every exception and how it was closed, and a completeness statement naming what could not be observed.
Assure treats an agent as a preparer that never approves its own work. Whether your control design satisfies your external auditor is between you and them.
-
ISO/IEC 42001
Operating contracts stand as the documented purpose, scope and ownership of each agent. The pack adds the control blueprint versions in force, the human oversight record, the incident and exception log, and the measures each pack reports.
Ayion Meru is built to align with the standard’s structure. Ayion is not certified to ISO/IEC 42001 and no certification body has assessed us.
-
NIST AI RMF
Map, measure and manage, as records rather than as a document: what each agent is for and what it may touch, which controls applied and how they decided, what was measured over the period, and what was done about the exceptions.
The framework is voluntary and has no certification. Anyone claiming to be certified against it is describing something that does not exist.
-
EU AI Act
The logging, human oversight and record-keeping obligations that fall on a deployer: an automatic log per action, the person who oversaw it, the parameters it ran on, and retention of both the log and the oversight.
Whether a given agent is high risk under the Act is your classification to make, on your use of it. Assure produces the records that classification then requires; it does not make the call for you.
-
Insurer questionnaire
The answers an underwriter asks for at an AI liability or cyber renewal: which agents can act, on which systems, what they may spend, what stops them, how often a person corrects them, and what actually happened the last time a control fired.
No insurer has priced a policy on an Ayion pack. The pack is written to be answerable, not to be a discount.
Security posture and roadmap
What is built, and what is not.
Read the status column first. It is the honest half of the table.
Ayion Meru is pre-launch. “Built” means the platform has it today. It does not mean a third party has verified it, and nothing on this page is a certification.
| Practice | What it means | Status |
|---|---|---|
| Single sign-on and SCIM | SAML or OIDC sign-on, and directory-driven provisioning and de-provisioning for people and for auditor seats. | Built |
| Tenant isolation | One tenant’s ledger, keys and exports are separated from every other tenant’s. | Built |
| Customer-held keys | Evidence records and exports are sealed with keys you hold rather than keys we hold on your behalf. | Built |
| Audit of the auditor | Every read of the ledger is itself a record in the ledger, including reads by Ayion. | Built |
| External penetration test | An independent test of the platform. It happens before enforce mode ships, so nobody runs a blocking control on untested code. | Before enforce mode |
| SOC 2 Type I | A target. We hold no SOC 2 report of any type today, and we will not publish a date until the audit is booked. | Target |
| ISO/IEC 42001 | An alignment. The platform is built to the standard’s structure; no certification body has assessed us against it. | Alignment |
| Private deployment | Running Ayion Meru inside your own cloud rather than ours. On the roadmap, not at launch. | Roadmap |
Where we actually stand
What we do not have yet.
A security page that lists only strengths is a sales page. These are the gaps, named, so that a reviewer can rule us out in five minutes if one of them is disqualifying rather than in five weeks.
-
No certifications.
No SOC 2 of either type, no ISO/IEC 27001, no ISO/IEC 42001 certificate, nothing else. A questionnaire that requires one today should rule us out today.
-
No completed penetration test.
The external test happens before enforce mode ships. Until it has been done and the findings closed, we will not tell you it has.
-
No published sub-processor list.
This page does not carry one yet. Ask security and you get the current list in writing before anything is signed.
-
No public status page.
There is nothing to link to. When there is, it will be linked from this page and from the footer.
-
No named residency regions.
Regional residency is planned. We are not naming a region until a tenant can actually be placed in it.
-
No auditor has accepted an evidence pack.
The packs are mapped to the frameworks above and no auditor has been handed one. When that changes, this line changes before anything else on the site does.
-
No customers to name.
Ayion has no customers to reference, no logos to show and no track record to point at. What we have is the architecture, this page, and a pilot you can run on your own systems.
Responsible disclosure
Tell us before you tell anyone else.
Send anything you find to security@ayion.ai. We acknowledge a report within two working days and tell you what we are doing about it.
security@ayion.ai-
What to include
The affected endpoint or page, the steps to reproduce, what you were able to reach, and the time and time zone. A proof of concept helps. A raw scanner report on its own is not something we can act on.
-
What we commit to
We will not pursue anyone who reports in good faith, tests only against their own tenant or account, does not access or alter anyone else’s data, and gives us time to fix the issue before publishing.
-
What we do not run
There is no bug bounty and no payment. We will credit you by name in the fix note if you want that, and say nothing if you do not.
Health data
JhiOn, and the rules that apply to it.
JhiOn is Ayion’s first vertical platform and the only one that touches health data. It runs on the same ledger as everything else, under stricter consent.
- Consent comes first and is recorded as an evidence record of its own, with the version of what was consented to.
- Health data is encrypted, is never sold, and can be exported or deleted by the person it belongs to.
- JhiOn is built to India’s Digital Personal Data Protection Act, the GDPR and HIPAA, each where it applies.
- Where a clinician is involved, their oversight of an agent’s action is part of the record rather than an email beside it.
Health information disclaimer
JhiOn provides information and tools to help you manage your health. It is not medical advice, does not diagnose or treat any condition, and does not replace a qualified clinician. Consult a professional before changing medication, diet or exercise.
Asked first, every time
Questions a security team opens with.
Can we buy Assure without Run?
Yes. Assure is sold and priced on its own, and it records what any agent did, including agents Ayion did not build. That is the whole point of the independence rule rather than a concession to it.
What happens to our evidence if we stop paying?
Evidence packs are files. They export in formats that read without Ayion, they are sealed with your keys, and every pack produced while you were a customer stays yours. Nothing about verifying an old record requires a live account.
Can Ayion read our business data?
The ledger holds references, hashes and redacted parameters rather than your records, so there is little there to read. What is held is sealed with your keys, and every read of a tenant’s ledger, ours included, is recorded in that same ledger.
Do you have a SOC 2 report?
No. Not Type I and not Type II. Type I is a target and we will not publish a date until the audit is booked. If your process requires a report today, we are the wrong vendor today.
Has an auditor accepted one of your evidence packs?
No. None has been given one. The packs are mapped to SOX/ICFR, ISO/IEC 42001, the NIST AI RMF, the EU AI Act and insurer questionnaires, which is a statement about what a pack contains, not about who has blessed it.
Will you complete our questionnaire?
Yes. Send it to security@ayion.ai and send it early, before the commercial conversation rather than after it. Where the honest answer is “not yet”, that is the answer you will get in writing.
Send the questionnaire before the demo.
If something on this page rules us out, we would rather find that out in week one than in week six.