Security and data residency
Secured, and plain about it.
Hosted in AWS Mumbai across 3 availability zones. No model sits in the path that allows an action. We hold no security certifications today, and say so.
Data residency
Your data stays in India.
Customer data is processed in Mumbai, with no US region. New regions open on a signed contract, never a forecast.
For regulated buyers, elan1 Run can carry the whole stack inside your own cloud account in India, so the data and the keys stay with you.
- Hosting region
- AWS Asia Pacific (Mumbai)
- Availability zones
- 3
- US region
- None
- elan1 Run deployments
- Your cloud account in India, or an operator's data centre in the Mumbai region
- New regions
- Open on a signed contract, never a forecast
- Exports
- Records and configuration in open formats, yours if you leave
Status: Available Region and residency apply to every environment we operate today.
Architecture
No model in the path that allows.
Security starts with what an agent cannot do. Models can propose actions. Only your rules, and the person you name, let one happen.
Rules before the action
Keys the agent never sees
A signed, chained record
One emergency stop
Responsible AI
A model may propose. Never allow.
Your rules and a person you name decide. Failures fall toward a human, never toward an action.
- Every answer from elan1 Decide states how sure it is, and where it went next.
- Credit, anti-money-laundering outcomes, clinical intake and hiring are always recommend-only: a person decides.
- Automation switches on only after a shadow run matches your current process on your own data. No calibration, no automation.
- Personal data is masked before a model reads it, and stays in-region.
- Real outcomes are joined back, so confidence stays honest over time.
Propose
Applications
Decide
Governanceelan1 GovernAllow · ask a person · refuseCarry
Runtimeelan1 RunIn your country, on your cloudelan1 Work and elan1 Decide propose. elan1 Govern decides. elan1 Run carries, routes, meters and records.
Certifications
None today, and we say so.
We hold no security or AI-management certification today: not ISO/IEC 27001, not SOC 2, not ISO/IEC 42001. We will not imply otherwise with badges, “aligned with” language or logos.
When an audit starts, we list it here with its scope and auditor, before any result. When a result arrives, the matching claims move to Proven in the register.
This website sends strict transport security, content-type, framing, referrer and permissions headers on every response, and sets no advertising cookies.
Incident response
If something goes wrong, you hear first.
If an incident affects your data, we tell you without undue delay, with what we know, what we have stopped and what happens next.
We report to India’s CERT-In within the window its directions set, and notify the Data Protection Board of India and affected people of a personal-data breach as the Digital Personal Data Protection Act 2023 requires.
Logs that an investigation needs are kept in India.
6 hours
to report a cyber incident to CERT-In.
Regulation: CERT-In directions, April 2022
Vulnerability disclosure
Found a weakness? Tell us.
We welcome reports from security researchers, customers and anyone else. Report in good faith and we will work with you, not against you.
How to report
Email the security team. Encrypt if you can; plain text is fine.
Machine-readable contact: /.well-known/security.txt
What to include
- The address or component affected
- Steps to reproduce, and what you expected
- The impact you think it has
- How we can reach you to credit you, if you wish
What we commit to
- Acknowledge your report within 2 working days
- Keep you told until it is fixed
- No legal action for good-faith research that respects this policy
- Credit you when the fix is published, if you want it
In scope
elan1.ai and its subdomains, including docs.elan1.ai and status.elan1.ai, and elan1 platform environments we operate.
Out of scope
Denial of service, social engineering of staff, physical attacks, and sites run by other brands, including commerce1.ai, strategy1.ai and brand1.ai, which have their own contacts. Do not access, change or keep data that is not yours.
This policy is a draft for counsel review, version 1, last reviewed 2 November 2026.
Security FAQs
Security and residency, answered.
Is elan1 ISO 27001 or SOC 2 certified?
No. elan1 holds no security or AI-management certification today: not ISO/IEC 27001, not SOC 2 and not ISO/IEC 42001. When an audit starts, we list its scope and auditor on this page before any result, and the matching claims move to Proven in the claims register.
Can elan1 run inside our own cloud account in India?
That is what elan1 Run is designed for. For regulated buyers, it can carry the whole stack inside your own cloud account in India, or an operator's data centre in the Mumbai region, so the data and the keys stay with you. On-premises and air-gapped deployment is on the roadmap as planned, not available today.
Is personal data sent to AI models?
Personal data is masked before a model reads it, and it stays in-region. In the banking configuration, for example, Aadhaar, PAN and account numbers are masked before any model sees them. Credit, anti-money-laundering outcomes, clinical intake and hiring are always recommend-only: a person decides.
How does elan1 report a security incident?
If an incident affects your data, we tell you without undue delay, with what we know, what we have stopped and what happens next. We report to CERT-In within the 6 hours its April 2022 directions set, and notify the Data Protection Board of India and affected people of a personal-data breach as the DPDP Act 2023 requires.
How do I report a vulnerability to elan1?
Email security@elan1.ai, or use the contact in /.well-known/security.txt. Include the address or component affected, steps to reproduce, the impact you think it has and how to credit you. We acknowledge reports within 2 working days and take no legal action over good-faith research that respects this policy.
Intelligence you can answer for.
Start with one process. Add the next when it holds.