Skip to content
NewWatch the two minute introduction to EndLayerWatch now →
Trust & security

Review the controls.
Inspect the evidence.

EndLayer is developed and operated by Holistic AI. Review the published security programme, collection boundaries and available evidence for your procurement process.

Request evidence ↗Browse documents ↓
Published assurance

Know the status and the scope.

The live Holistic AI trust centre is the source for these statuses. Review the reports and current scope under a mutual NDA.

Certified

ISO/IEC 27001:2022

The information security management system supports development and deployment of the Holistic AI platform, including EndLayer.

Report available

SOC 2 Type 2

The published report covers Security, Availability, Confidentiality and Privacy. Processing Integrity was not examined.

In progress

ISO/IEC 42001

Work towards an AI management system certification is under way. This certification is not held today.

Status checked 19 October 2026 against the published trust centre ↗.

Data handling

Understand the boundary first.

Review discovery, supported local enforcement and stored evidence as distinct parts of the data flow.

01 / Endpoint

Observe & redact

Collect supported signals. Remove secret values from discovery evidence.

02 / Transfer

Encrypt & deliver

Send evidence through an encrypted outbound route.

03 / Platform

Review & retain

Apply access, retention and evidence controls in the deployment.

01

Collection choices

Prompt and response collection is off by default. Local request inspection is distinct from storing conversation content.

02

Data location

The published hosted-service default is London, with US hosting options. Confirm your region and transfer terms in the agreement.

03

Retention & deletion

Review the contracted retention timeline, deletion process and export needs with the team before deployment.

Security programme

Practices behind the platform.

A concise view of published controls. Request the policy or audit evidence relevant to your review.

01

Encryption

The hosted programme specifies TLS 1.2+ in transit and AES-256 at rest via AWS KMS.

02

Access control

Least-privilege access, restricted administrative rights and periodic access reviews.

03

Secure development

Code review, separated environments, security testing and controlled production changes.

04

Independent testing

Annual independent penetration testing. An executive summary is available under NDA.

05

Incident response

Documented detection, response and notification procedures. Contracted notification timelines apply.

06

Continuity

Documented backup, recovery and business-continuity processes with supporting evidence.

Evidence library

Ask for the documents you need.

Search selected review documents below. The full published catalogue lists 39 documents. Reports and policies are released under a mutual NDA.

18 documents

Full published document catalogue ↗
Subprocessors

Who supports the hosted service.

The current published list identifies these providers. Confirm applicable services, regions and transfer safeguards in the DPA.

Amazon Web Services

Hosting, backup and disaster recovery.

UK · US

Google Cloud Platform

Alternative hosting for US customers where required.

US

WorkOS

Authentication, single sign-on and directory management.

US

Twilio SendGrid

Transactional service and account email.

US
Start your security review.

The team can provide evidence under NDA and respond to SIG, CAIQ, VSA, HECVAT or your own questionnaire.

Request documents ↗