Single-tenant VPC in the EU
We operate and monitor the system in a dedicated European VPC. Nothing is shared with another client, and data never leaves the region you choose.
Operated by Farvex
Security
Security, and who can reach your data
Where your data lives, who can get to it, and what we will never do with it — set out so your security team can work through it line by line.
EU hosting
AES-256 at rest
TLS 1.3 in transit
On-premise option
Data sovereignty
Two places it can live
You pick where the system sits before we build anything, and that choice changes none of the controls further down.
On-premise, on your servers
The entire stack runs on your own internal servers, air-gapped if your policy demands it. You hold the keys, the logs and the hardware.
Operated by you
- No data resale — we do not monetise your data and we pull no telemetry out of it.
- On-premise ready — every component can run entirely on your own internal servers.
- 24/7 security operations — automated vulnerability scanning runs against the deployment without pause.
- Risk-classified under the EU AI Act — every system we put into production is classified and fully auditable.
Controls
Six controls that hold on every deployment
The same rules apply whether we run the system in a European VPC or you run it on your own servers.
No training on your data
Your documents, OCR text and ERP entries are never used to train or calibrate third-party foundation models. That guarantee is legally binding.
Legally binding
EU data residency
Every compute instance sits inside a European data centre — the Netherlands, Germany or France — under EU data custody law. GDPR and the Dutch AVG apply throughout.
EU only
Encrypted in transit and at rest
Traffic is protected by TLS 1.3 with Perfect Forward Secrecy. Data at rest is encrypted with AES-256, and you hold the keys in an HSM.
AES-256 and TLS 1.3
Single-tenant infrastructure
Enterprise deployments run on physically isolated single-tenant infrastructure, with dedicated compute nodes and private IP ranges.
Dedicated tenancy
Append-only audit logs
Immutable cryptographic append-only trails record every inference request, access event and ERP sync.
Tamper-proof
Deterministic circuit breakers
Agents work inside strict deterministic bounds. Any anomaly or out-of-bounds parameter trips an immediate safe freeze.
Safe freeze
Compliance
The frameworks we build against
Farvex is built to satisfy the requirements below. The status column states precisely where each one stands.
| Framework | What it covers | Status |
|---|---|---|
| GDPR / Dutch AVG | European and Dutch rules for handling personal data. | In place |
| EU AI Act | Risk classification and auditability of deployed AI systems. | Risk-classified |
| ISO 27001 | The standard for managing information security. | Built to meet |
| SOC 2 Type II | An audit of how security controls perform over a period of time. | Built to meet |
| DNB (Dutch Central Bank) | Supervision of Dutch financial institutions and their suppliers. | Built to meet |
| AFM | The Dutch financial markets authority. | Built to meet |
“Built to meet” means the controls are designed against that framework. It is not a claim of certification. We hand over our control descriptions and evidence whenever your auditors ask for them.
Disclosure
Reporting a vulnerability
Send what you found to security@farvex.ai. Our contact addresses, preferred languages and policy URL are published in the standard security.txt format.
Give this page to your security team
In one session we walk through the architecture, the data flows and the controls, then answer your security questionnaire in writing.