Security Overview

Attababy is designed for sensitive, regulated, jurisdiction-aware, and high-value enterprise AI workloads.

The platform combines region-aligned infrastructure, tenant-specific execution environments, private model and retrieval services, connected infrastructure capabilities, and operational observability.

Specific security controls depend on the applicable deployment model, infrastructure environment, customer requirements, and governing agreement.

1. Configurable Persistence Controls

Attababy supports configurable persistence controls for sensitive AI workloads.

Depending on the applicable service and deployment configuration:

• Runtime environments may operate with reduced or zero-persistence modes.
• Intermediate processing data may be limited to transient runtime environments.
• Retention behavior can be configured according to workload and operational requirements.
• Customer workload content is not required in non-content operational audit streams.

Persistence behavior may vary by service, workload, connected infrastructure, and customer configuration.

2. Enclave-Capable and Isolated Execution

Attababy supports tenant-specific and enclave-capable execution environments for sensitive workloads.

Available capabilities may include:

• Runtime isolation.
• Hardware-backed confidential-computing capabilities where supported.
• Infrastructure segmentation.
• Tenant-specific execution environments.
• Restricted access to runtime systems.
• Configurable persistence options.

Specific confidential-computing or hardware capabilities depend on the participating infrastructure environment.

3. Region-Aligned Infrastructure and Routing

Attababy supports infrastructure deployment and routing based on configured regional, tenant, and enterprise requirements.

Capabilities may include:

• Region-aligned workload placement.
• Regional infrastructure boundaries.
• Tenant-aware deployment.
• Infrastructure-level routing.
• Connected and hosted infrastructure environments.
• On-premises and private deployment models where supported.

Customer residency and jurisdictional requirements are implemented according to the applicable deployment configuration and customer agreement.

4. Encryption

Attababy uses encryption and related security controls appropriate to the applicable infrastructure environment.

These may include:

• Encryption in transit using modern transport-security protocols.
• Encryption at rest.
• Infrastructure-native key-management capabilities.
• Confidential-computing or memory-isolation capabilities where supported.

Specific encryption implementations may vary by provider, deployment environment, and customer architecture.

5. Identity and Access Management

Attababy supports identity and access controls designed to restrict access to customer environments and platform services.

Capabilities may include:

• Role-based access control.
• Tenant-specific access boundaries.
• API and service credentials.
• Service-to-service authentication.
• Administrative access controls.
• Single sign-on integrations where supported.

Enterprise identity integrations may vary by deployment.

6. Monitoring and Operational Visibility

Attababy provides infrastructure-level observability designed to support security, operations, and audit workflows.

Operational records may include:

• Workload identifiers.
• Deployment and routing events.
• Region or infrastructure identifiers.
• Runtime and service events.
• Security and administrative events.
• Infrastructure-health information.

Attababy’s operational telemetry is designed to avoid requiring prompts, embeddings, model content, or other application content in non-content audit streams.

Retention periods are configurable where supported and may also be governed by applicable customer agreements.

7. Hosted, Connected, and Hybrid Infrastructure Security

Attababy may operate across:

• Attababy-hosted infrastructure.
• Customer VPCs.
• Private cloud environments.
• On-premises infrastructure.
• Connected external infrastructure.
• Hybrid combinations of these environments.

Security responsibilities vary by deployment model.

For customer-controlled or third-party infrastructure, the customer or participating provider remains responsible for security controls under its control.

Deployment responsibilities are defined through applicable technical documentation and customer agreements.

8. Infrastructure Security

Attababy relies on cloud, data-center, network, and infrastructure providers with security controls appropriate to their role in the applicable deployment.

Depending on the environment, these controls may include:

• Physical access controls.
• Facility monitoring.
• Power and environmental redundancy.
• Network segmentation.
• Infrastructure monitoring.
• Access logging.
• Provider security and compliance programs.

Physical security capabilities vary by infrastructure provider and deployment location.

9. Secure Development and Operations

Attababy applies security practices across platform development and operations, which may include:

• Controlled production access.
• Environment separation.
• Change management.
• Dependency and vulnerability management.
• Security logging.
• Incident-response processes.
• Backup and recovery procedures.
• Infrastructure configuration controls.

Security practices continue to evolve as the platform and customer deployment footprint expand.

10. Compliance and Assurance Program

Attababy is developing its formal security and compliance program as the platform moves through enterprise deployment and production expansion.

Current areas of focus may include:

• SOC 2 readiness and certification planning.
• Privacy and data-protection requirements.
• HIPAA-supporting infrastructure controls where applicable.
• GDPR-aligned data-processing practices.
• EU AI Act readiness.
• Customer-specific security and diligence requirements.

References to a regulatory framework do not mean that every Attababy service, deployment, or customer workload is automatically compliant with that framework.

Compliance depends on the applicable deployment, configuration, customer obligations, contractual requirements, and use case.

11. Customer Security Responsibilities

Customers remain responsible for security controls within systems and environments under their control, including:

• User and administrator access.
• Identity-provider configuration.
• Customer-managed credentials.
• Application security.
• Data classification.
• Connected infrastructure.
• Customer-selected models and tools.
• Regulatory and compliance obligations applicable to their workloads.

Attababy works with customers to define infrastructure responsibilities during deployment planning and implementation.