Compliance and data protection, stated plainly
Where Orcana runs, what it can access and what it logs: everything your security review will ask.
SOC 2 Type II compliantISO 27001 compliantHIPAA compliantGDPR compliant21 CFR Part 11 support
The details
The controls behind every deployment
Deployment and data residency
Runs in your VPC
- Orcana deploys in your VPC, on your cloud
- No data leaves your cloud account or region
- Works on the cloud you already use
Encryption
At rest and in transit
- AES-256 encryption at rest
- TLS 1.2+ in transit
Identity and access
Your directory, your roles
- Role-based access
- SSO via SAML
- SCIM provisioning
Audit and governance
Every step on the record
- Immutable audit trail
- Model registry
- Change control
AI data policy
Your models, your data
- Runs the Orcana and your private models, plus any model your IT approves
- Your data trains only your own private model, never the Orcana model or anyone else's. We'll put that in writing
Penetration testing
Tested independently
- Penetration test completed. Ask us for the results
Validation support · 21 CFR Part 11
Documentation for your validation
Every Part 11 validation is specific to your system and your environment. We give your validation team the documentation to do it.
A questionnaire to fill in, or a question about this page? Email info@orcana.ai
Get started
Pick one decision loop. We'll have it running on your data in 7–14 days
Runs in your cloudOne use case first, then scaleSOC 2 Type II and ISO 27001 compliant