Security and Governance
Confidential by Architecture. Evidence You Can Inspect.
Written for your CISO, DPO and QA team. Here is what runs where, what never leaves your account, and how Axenivo is designed to support the regulations your organisation works under.
What Leaves Your Account, and What Never Does
Never Leaves
- Trial and Patient DataListings, case report forms, investigator notes and anything identifying a person.
- Safety CasesAdverse event reports, narratives and medical history.
- Compound and Assay DataStructures, results and structure-activity data.
- Submissions and DisclosuresDraft dossiers, agency correspondence and invention disclosures.
- Prompts, Outputs and LogsEvery request and answer, including the audit trail.
May Leave, Under Your Control
- Operational Health MetricsCPU, GPU, latency and error rates, which you can inspect or switch off.
- Public-Only TasksPublished literature and public guidance you route to managed AI, under a monthly cap.
- Nothing ElseManaged AI can be switched off per task, per programme or entirely.
Data Flows by Task
Each workflow’s route, where it is processed and what is logged.
| Workflow | Route | Processed in | Logged |
|---|---|---|---|
| Safety case intake | Private AI | Your cloud account | Request, sources, route, approval |
| Clinical study report drafting | Private AI | Your cloud account | Request, sources, route, approval |
| Regulatory submissions | Private AI | Your cloud account | Request, sources, route, approval |
| Compound and assay analysis | Private AI | Your cloud account | Request, sources, route, approval |
| Patent and FTO scans | Private AI | Your cloud account; public patents retrieved into it | Request, sources, route, approval |
| Literature and public guidance | Managed AI | Managed model for public text; mapping in your account | Request, public sources, route, cost |
Regulations Mapped to Controls
Axenivo is designed to support these frameworks. Compliance itself depends on your intended use, your validation and your procedures.
| Framework | What it asks for | How Axenivo supports it |
|---|---|---|
| GDPR | Lawful, minimal processing of personal data, including special-category health data; impact assessments; control over processors and transfers | Processing only inside your account and region; no transfer of personal data to managed models; access control and logs; documentation for your DPIA |
| HIPAA | Safeguards for protected health information and control over business associates | PHI stays in your environment; role-based access; audit trails; encryption at rest and in transit |
| EU AI Act | Risk management, transparency, human oversight and record-keeping for AI systems, depending on their risk class | Intended use defined per workflow; expert review on every output; full logging; documentation for your AI risk assessment |
| EU GMP Annex 11 | Validated computerised systems, audit trails, access control, change and configuration management | Versioned configurations; evaluation-gated releases with rollback; test records; audit trails; validation documentation |
| FDA 21 CFR Part 11 | Trustworthy electronic records and signatures, with audit trails and access control | Time-stamped audit trail of requests, sources and approvals; role-based access; records retained in your account |
| ICH E6(R3) GCP | Data integrity, risk-proportionate oversight and control of systems used in clinical trials | Traceable sources for every statement; sponsor- and study-scoped access; logs to support vendor and system oversight |
| EU GVP (Modules VI and IX) | Timely, accurate handling of adverse reaction reports and signal management | Case drafts traced to source documents; a qualified person decides on every case; nothing is reported automatically |
This table describes platform controls, not legal advice. Your QA, regulatory and data-protection teams decide how each framework applies to your use.
What You Receive Before You Decide
- Security OverviewArchitecture, data flows, access model and telemetry.
- Validation PackConfiguration records, test approach and change control, to support computerised system validation.
- Supplier Qualification AnswersResponses for your supplier or sponsor questionnaires.
- Data-Protection DocumentationProcessing description and inputs for your DPIA.
Security and QA Questions
What exactly leaves our cloud account?
Trial, safety, compound and submission data never leaves, including prompts, outputs, documents and logs. Only operational health metrics leave, which you can inspect or switch off. Managed AI receives only the public sources and public-only tasks you route to it, under a monthly cap you set.
Can you access our data?
No. We operate the platform from outside your account using deployment and monitoring access that does not include your documents, prompts or outputs. Access for support is granted by you, time-limited and logged.
Is Axenivo GxP compliant?
Axenivo is designed to support GxP expectations such as EU GMP Annex 11 and FDA 21 CFR Part 11, with audit trails, access control, versioned configurations and validation documentation. Compliance itself depends on your intended use, your validation and your procedures.
Is any of our data used to train models for other customers?
No. Models tuned on your data stay in your account, and nothing you build trains anyone else’s model.
Where is data processed?
In your own cloud account or data centre, in the region you choose, in Europe or North America.
How are managed models kept away from confidential data?
Every request passes a policy check before any model sees it. Anything involving trial, patient, safety, compound or submission data, or where the check is unsure, stays private. You can switch managed AI off per task type, per programme or entirely.
Request the Security Pack
We will send the security overview and validation approach, and set up a call with your CISO, DPO or QA lead.