Security built for regulated medical device work
EU-hosted. Encrypted in transit and at rest. Never used to train AI. Independently pentested.
EU-only hosting
100% of customer data stays in European data centers, under EU jurisdiction.
Encrypted everywhere
TLS 1.3 in transit, AES-256 at rest. No exception.
Not used to train AI
Your documents never become training data — contractually and technically. See how our AI is built →
Independently pentested
Annual external penetration tests by an independent provider.
ISO 27001-aligned
Processes aligned on ISO 27001, mapped and documented in our QMS.
Hosting and infrastructure
Your data is hosted exclusively in the European Union, on infrastructure that is isolated, encrypted, and backed up by design.
- Data centers located in the European Union, under EU jurisdiction.
- Protected against extraterritorial access (US Cloud Act, FISA): data does not leave EU soil.
- Encrypted at rest (AES-256) and in transit (TLS 1.3), including all backups.
- Automated daily backups with defined retention and tested recovery procedures. SecNumCloud partners available for the strictest requirements.
Data protection and privacy
Your documents remain your property. We process them to deliver the service — nothing else.
- Your data is never used to train AI models — ours or any third party's. See how our AI is designed →
- GDPR-compliant Data Processing Agreement (art. 28) signable before use.
- Published sub-processor list, with advance notice of any change.
- Clear data residency: documents, analysis artifacts, and logs remain in the EU.
Operations
Security operations are documented processes, not ad-hoc reactions — every incident follows a defined response, every vulnerability is tracked to closure.
- Documented incident response procedure with defined notification SLAs.
- Vulnerability management: dependency scanning, periodic patching, hardened baseline images.
Independent validation
Security isn't stated — it's demonstrated and re-demonstrated.
- Annual third-party penetration test on the production platform, with remediation plan.
- ISO 27001 control mapping and gap analysis, documented and maintained in our QMS.
- Continuous monitoring of security events, availability, and performance.
- Customer security reviews welcomed — we answer standard questionnaires (SIG, CAIQ, or custom).
Have a vendor security questionnaire?
Send us your SIG, CAIQ, or internal format — we'll route it to the right team.
Security FAQ
Where is our data stored?
Your data is stored exclusively in European Union data centers, under EU jurisdiction. It does not leave EU territory, and our infrastructure is designed to resist extraterritorial access requests (e.g., US Cloud Act, FISA).
What happens if we want to delete our data?
On request, we delete your data from production and backups according to our retention policy. Contact us to initiate a deletion request.
Can we receive your pentest report and security documentation?
Yes. Under NDA, we share our latest external pentest report, our ISO 27001 control mapping, our architecture document, our sub-processor list, and our DPA. Write to contact@gordios.app to request access.
Want to learn more?
Schedule a meeting with one of our specialists to best address your needs!
Book a demo