contact us

sevaka

Security

Introduction

At Sevaka, we understand that the privacy and security of your data are paramount. Our AI Financial Advisor solution is built on the core principle that “your data is your data.” This document outlines our comprehensive approach to ensuring the security, privacy, and resilience of our service, giving you confidence that your sensitive information is protected at all times.

1. Cloud Infrastructure and Resilience

Why it matters

A robust and resilient cloud infrastructure is the foundation of our service, crucial for maintaining business continuity, ensuring scalability, and protecting your data against unforeseen events. Our architecture is designed to provide the highest levels of security, availability, and performance.

Our Approach

High Availability and Fault Tolerance

  • Multi-AZ Deployment: Our infrastructure is distributed across multiple Availability Zones (AZs) within each region, ensuring continuity even if an entire AZ fails.
  • Active/Passive Multi-Region: For customers with the highest availability requirements, we offer active/passive deployments across geographically diverse regions, providing resilience against large-scale regional outages.
  • Load Balancing: We use advanced load balancing techniques to distribute traffic evenly and handle failover scenarios seamlessly.

Scalability and Performance

  • Auto-scaling: Our systems automatically scale based on demand, ensuring optimal performance during peak usage and cost-efficiency during quieter periods.
  • Content Delivery Network (CDN): Static assets are distributed via a global CDN to reduce latency and improve user experience.
  • Database Optimization: We employ read replicas and caching strategies to enhance database performance and reduce load on primary database instances.

Secure Network Architecture

  • Virtual Private Cloud (VPC): All our resources operate within isolated network environments, with strict controls on inbound and outbound traffic.
  • Network Segmentation: We use subnets and network ACLs to create separate tiers for web, application, and database layers, minimising the attack surface.
    Web Application Firewall (WAF): Application-layer protection against common web exploits and bots.
  • DDoS Protection: We implement advanced DDoS mitigation techniques to ensure service availability even under attack conditions.

Infrastructure Security

  • Encryption at Rest: All stored data is encrypted using AES-256, with keys managed through cloud provider key management services.
  • Encryption in Transit: All data in transit is protected using TLS 1.3, ensuring secure communication between all components.
  • Access Controls:
    • Role-Based Access Control (RBAC) for granular permission management.
    • Just-In-Time (JIT) access for administrative tasks, reducing the window of potential exploitation.
    • Multi-Factor Authentication (MFA) required for all administrative access.
  • User Authentication:
    • Support for OAuth 2.0 and OpenID Connect (OIDC) for secure, standardised authentication flows.
    • Integration with Active Directory and Azure AD for enterprise clients, allowing seamless Single Sign-On (SSO) experiences.
    • Option for SAML 2.0 integration for clients with existing Identity Providers.
  • Immutable Infrastructure: We use infrastructure-as-code and immutable deployment practices, reducing the risk of configuration drift and unauthorised changes.

Monitoring and Incident Response

  • Real-time Monitoring: Comprehensive monitoring of all infrastructure components, with automated alerts for anomalies.
  • Log Aggregation: Centralised logging for easy analysis and auditing.
  • Automated Remediation: Where possible, we implement auto-remediation for common issues to minimise human intervention and reduce response times.

Compliance and Governance

  • Regulatory Alignment: Our infrastructure is designed to meet various regulatory requirements, including GDPR, HIPAA, and financial services regulations.
  • Regular Audits: We conduct regular internal and external audits of our infrastructure to ensure compliance and identify areas for improvement.

Continuous Improvement

We are committed to continuously enhancing our cloud infrastructure. This includes:

  • Regular reviews of cloud provider offerings to leverage new security features and performance improvements.
  • Ongoing optimization of our architecture based on performance metrics and security best practices.
  • Incorporation of feedback from penetration tests and security audits to further strengthen our infrastructure.

Our cloud infrastructure forms the secure, scalable, and resilient foundation upon which we build all our services, ensuring that your data remains protected, available, and performant at all times.

2. AI Security and Data Privacy

Why it matters

AI technologies, while powerful, require stringent security measures to protect against misuse and ensure the privacy of your data. Our approach to data privacy is foundational to maintaining trust and compliance.

AI Security Measures

  • Stateless LLMs: Our Large Language Models (LLMs) are stateless and have no persistent memory of your data.
  • Isolated Fine-Tuning: Any fine-tuned models are specific to individual tenants and never shared.
  • Prohibited Topics: Strict controls and guardrails prevent the AI from engaging with prohibited or sensitive topics.
  • Content Moderation: Built in guardrail filters prevent inappropriate content generation.
  • Prompt Injection Detection: We use 3rd party tools, and our own agent based approach to detect prompt injection at source before being processed by our LLM models.

Data Privacy and Isolation

  • Strict Data Isolation: We never reuse your data for training LLMs or any other purpose outside of your own use. Your data remains exclusively yours and is only accessible by you.
  • Geographic Control: We define and maintain strict controls on the region where your data resides.
  • Cross-Contamination Prevention: Customer data, domain knowledge, and logs are stored in isolated storage resources, and are access restricted to your account only.
  • Single-Tenant Environment: Available upon request, ensuring your data and processing are completely isolated from other customers.

Data Processing and Auditing Transparency

  • Isolated Data Processing: Your data is processed on major cloud providers (e.g., AWS, Azure) and is never exposed to LLM providers such as Anthropic. So your data is secure and remains private.
  • Full Audit Trail:
    • Comprehensive logging of all data access and operations for transparency and compliance.
    • AI decision chain-of-thought logs are kept and are available to you for your own audit requirements.
  • On-Demand Data Gathering: Data is collected and processed only as needed for authorised operations.

3. Release Management and Deployments

Why it matters

Proper release management and deployment processes are critical for maintaining system stability, security, and performance while introducing new features and improvements.

Our Approach

  • Blue/Green Deployments: We use a blue/green deployment strategy to minimise downtime and risk.
  • Canary Releases: New versions are initially exposed to a small percentage of traffic to detect any issues before full rollout.
  • Zero Downtime Deployments: Our strategies ensure seamless updates without service interruption.
  • Automated Rollbacks: In case of detected issues, we can quickly roll back to the previous stable version.

Change Advisory Board (CAB) Process

  • Regular CAB meetings to review and approve all significant changes.
  • Thorough risk assessment and rollback plans for each deployment.
  • Smoke testing and automated health checks post-deployment.
  • Rapid rollback capabilities (typically within 5-15 minutes) if issues are detected.

4. Testing and Quality Assurance

Why it matters

Rigorous testing ensures the reliability, security, and trustworthiness of our product, giving you confidence in its performance.

Our Approach

  • Regression Testing: Comprehensive testing of new LLM versions against established benchmarks and expected responses to ensure consistent quality.
  • Load Testing: Simulating high-traffic scenarios to ensure performance under stress.
  • Penetration Testing: Regular third-party security assessments to identify and address vulnerabilities.
  • Security Scanning: Continuous automated scans for known vulnerabilities and security issues.
  • Bring Your Own Pen Testing: We welcome and support customer-initiated penetration testing.

5. Disaster Recovery and Business Continuity

Why it matters

Preparing for unforeseen events is crucial to ensuring the availability and integrity of your data and our services.

Our Approach

  • Active/Passive Multi-Region Infrastructure: Rapid failover capabilities to maintain service in the event of a regional outage.
  • Regular DR Drills: Frequent testing of our disaster recovery procedures to ensure readiness.
  • Incident Management: Clear categorization and prioritisation of incidents, with communication and remediation according to agreed-upon SLAs.

6. Compliance and Data Governance

Why it matters

Adherence to industry standards and regulations is crucial for maintaining trust and ensuring the protection of sensitive financial data.

Our Approach

  • Compliance Certifications: We maintain SOC 2 Type II and ISO/IEC 27001 certifications.
  • Regulatory Compliance: Our practices are aligned with GDPR, CCPA, HIPPA and other relevant regulations.
  • Data Deletion: You can request data deletion at any time, which we will complete within 90 days as per regulatory requirements.

7. Service Level Agreements and Recovery Objectives

Why it matters

We understand that each customer has unique requirements for service availability and data recovery. Tailored SLAs and recovery objectives ensure that our service aligns perfectly with your business needs.

Our Approach

  • Customised SLAs: We work closely with each customer to establish Service Level Agreements that meet their specific needs and expectations.
  • Individualised Recovery Objectives: Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) are agreed upon individually as part of our SLA agreement.
  • Flexible Solutions: Our infrastructure and processes are designed to accommodate a wide range of SLA and recovery requirements, allowing us to cater to diverse customer needs.

Conclusion

At Sevaka, security, privacy, and resilience are at the forefront of everything we do. We are committed to maintaining the highest standards of data protection and service quality. Our comprehensive approach ensures that your data remains your data – private, secure, and available when you need it.

We welcome the opportunity to discuss our security measures in more detail and to work with you to ensure that our solution meets your specific needs and compliance requirements.

Glossary

  • AES-256: Advanced Encryption Standard with a 256-bit key length, a widely used encryption algorithm.
  • Azure Key Vault: A cloud service for securely storing and accessing secrets provided by Microsoft Azure.
  • AWS KMS: Amazon Web Services Key Management Service, a service for creating and managing cryptographic keys.
  • CDN: Content Delivery Network, a geographically distributed network of proxy servers to provide high availability and performance.
  • DDoS: Distributed Denial of Service, a cyber-attack where multiple systems flood the bandwidth or resources of a targeted system.
  • GDPR: General Data Protection Regulation, a regulation in EU law on data protection and privacy.
  • HIPAA: Health Insurance Portability and Accountability Act, US legislation that provides data privacy and security provisions for safeguarding medical information.
  • LLM: Large Language Model, an AI model trained on vast amounts of text data to generate human-like text.
  • MFA: Multi-Factor Authentication, a security system that requires more than one method of authentication to verify the user’s identity.
  • PII: Personally Identifiable Information, any data that could potentially identify a specific individual. Examples include:
    Full name
    Social Security number
    Driver’s licence number
    Bank account number
    Passport number
    Email address
    Home address
    Phone number
    Date of birth
  • RBAC: Role-Based Access Control, an approach to restricting system access to authorised users based on their role.
  • RPO: Recovery Point Objective, the maximum targeted period in which data might be lost due to a major incident.
  • RTO: Recovery Time Objective, the targeted duration of time within which a business process must be restored after a disaster.
  • SOC 2: Service Organization Control 2, a technical auditing process and certification for service providers storing customer data in the cloud.
  • TLS 1.3: Transport Layer Security version 1.3, a protocol for encrypting data sent over the Internet.
  • VPC: Virtual Private Cloud, an on-demand configurable pool of shared computing resources allocated within a public cloud environment.
  • WAF: Web Application Firewall, a specific form of application firewall that filters, monitors, and blocks HTTP traffic to and from a web service.

Appendix: Technical Specifications and Details

This appendix provides more detailed technical information to support the security, privacy, and resilience measures outlined in the main document.

A. Cloud Infrastructure Specifications

1. Network Security

  • VPC with private and public subnets
  • Network ACLs and Security Groups for traffic control
  • Web Application Firewall (WAF) for application-layer protection

B. Encryption and Data Protection

1. Encryption Standards

  • In-transit: TLS 1.3 for all data transmissions
  • At-rest: AES-256 for all stored data
  • Key Management: AWS KMS or Azure Key Vault, with automatic key rotation every 90 days

2. Data Isolation Mechanisms

  • Separate Blob / Object Storage containers for each customer
  • Dedicated database schemas or instances per customer
  • Virtual Private Cloud (VPC) isolation for network-level separation

C. AI and Machine Learning Safeguards

1. LLM Operational Constraints

  • Stateless operation ensured by clearing model memory after each interaction
  • No persistent storage of conversation history or context

2. Prompt Injection Detection

  • Real-time analysis of input prompts using proprietary NLP models
  • Automated filtering of potentially malicious instructions
  • Continuous updating of detection models based on emerging threats

3. Content Moderation

  • Multi-layered approach combining rule-based filters and ML models
  • Real-time scanning of AI-generated content before delivery
  • Regular updates to prohibited topic lists and content policies

D. Access Control and Authentication

1. Role-Based Access Control (RBAC) Implementation

  • Granular permission sets defined for each role
  • Least privilege principle applied to all access grants
  • Regular access reviews conducted quarterly

2. Multi-Factor Authentication (MFA)

  • Mandatory for all user accounts and system access
  • Support for TOTP-based authenticator apps and hardware security keys
  • Conditional access policies based on user location and device health

3. Just-In-Time (JIT) Access

  • Temporary elevated access granted through Azure AD Privileged
  • Identity Management or AWS IAM Access Analyzer
  • All privileged access requests logged and require justification
  • Automatic revocation of elevated permissions after 4 hours

E. Release Management and Deployment Specifications

1. Blue/Green Deployment Process

  • Parallel environments (Blue and Green) maintained for zero-downtime updates
  • Traffic routing managed through load balancers for seamless transitions
  • Automated health checks and smoke tests run on new deployments before traffic shift

2. Canary Release Strategy

  • Initial exposure limited to 5% of traffic for new releases
  • Gradual increase in traffic exposure over 24-hour period, contingent on performance metrics
  • Automated rollback triggered if error rates exceed predefined thresholds

3. Change Advisory Board (CAB) Workflow

  • Weekly CAB meetings for standard changes
  • Ad-hoc CAB convened for emergency changes
  • Mandatory change request documentation including:
    Detailed description of changes
    Impact analysis
    Test results
    Rollback plan
  • Multi-level approval process based on change criticality

4. Deployment Automation

  • CI/CD pipelines implemented using industry-standard tools (e.g., Jenkins, GitLab CI)
  • Infrastructure-as-Code (IaC) used for consistent environment provisioning
  • Automated security scans and quality gates integrated into deployment pipeline

F. Testing and Quality Assurance Protocols

1. Regression Testing

  • Automated test suites covering core functionalities
  • Performance benchmarks established for response times and accuracy
  • Compatibility testing across supported platforms and integrations

2. Load Testing

  • Simulated peak loads of 10x average daily traffic
  • Stress testing to identify breaking points and recovery behaviour
  • Continuous performance monitoring with alerting for anomalies

3. Security Testing

  • Quarterly third-party penetration tests
  • Daily automated vulnerability scans of infrastructure and applications
  • Annual red team exercises to simulate advanced persistent threats

G. Service Level Agreements and Recovery Objectives

1. Customised SLAs

  • Individually negotiated Service Level Agreements based on customer requirements
  • Regular SLA review and adjustment process to ensure ongoing alignment with business needs
  • Dedicated account management to oversee SLA compliance and communication

2. Recovery Time Objective (RTO)

  • Customisable RTO ranging from < 5 minutes to < 4 hours, depending on the agreed SLA
  • Tailored recovery processes designed to meet each customer’s specific RTO requirements
  • Regular testing and optimisation of recovery procedures to ensure RTO compliance

3. Recovery Point Objective (RPO)

  • Flexible RPO options ranging from near-zero data loss to < 15 minutes, based on individual SLA agreements
  • Customised data replication and backup strategies to meet agreed RPO
  • Continuous monitoring and reporting on actual RPO performance

H. Compliance and Audit

1. Compliance Certifications

  • SOC 2 Type II (annual audit)
  • ISO 27001:2013 certified
  • GDPR and CCPA compliant

2. Audit Logging

  • Comprehensive logging of all system events and user actions
  • Log retention period of 365 days
  • Tamper-evident logging using blockchain technology

3. Data Deletion Process

  • Secure data wiping using DoD 5220.22-M standard
  • Certificate of destruction provided upon request
  • Automated removal from all backup and archive systems within 90 days

I. Incident Response and Disaster Recovery

1. Incident Classification

  • P1 (Critical): < 1 hour response time, 24/7 support
  • P2 (High): < 4 hours response time, business hours support
  • P3 (Medium): < 24 hours response time, business hours support
  • P4 (Low): < 72 hours response time, business hours support

2. Disaster Recovery Testing

  • Full DR drill conducted bi-annually
  • Table-top exercises for various scenario responses quarterly
  • Automated failover testing monthly

This appendix provides a more detailed look at the technical implementations and standards that underpin our commitment to security, privacy, and resilience. For any additional specific information or clarification, please don’t hesitate to reach out to us.

Contact us

If you have any questions about our Security, please contact us.