ENTERPRISE
Everything procurement asks for.
Audited controls, contractual data guarantees, deployment models that respect your perimeter, and support commitments in writing.
SECURITY & COMPLIANCE
Built to pass procurement.
Audited controls, contractual data guarantees and deployment models that keep regulated data inside your perimeter.
SOC 2 Type II
Independently audited controls covering security, availability and confidentiality. Report available under NDA.
HIPAA
Compliant handling of protected health information, with BAAs available for covered engagements.
GDPR
Lawful processing, data subject rights and EU data residency options, backed by a standard DPA.
Encryption everywhere
TLS 1.3 in transit, AES-256 at rest, with key rotation on a fixed schedule.
Least-privilege access
Role-scoped access, time-bound elevation and mandatory review of every grant.
SSO & SCIM
SAML and OIDC single sign-on with automated provisioning and deprovisioning.
Audit logging
Immutable logs of every action, exportable to your SIEM in real time.
Data residency
Choose the region your data is processed and stored in, including EU-only.
Isolated environments
Dedicated infrastructure per customer where the engagement requires it.
DEPLOYMENT
Your perimeter, your rules.
Three deployment models. The right one depends on how far your data is allowed to travel.
Managed Cloud
We run and operate the system on our infrastructure, with monitoring and updates included.
- BEST FOR
- Fastest path to production
- DATA LOCATION
- Rufocus cloud, region of your choice
Your VPC
Deployed inside your cloud account. Your network boundary, your keys, our operational runbook.
- BEST FOR
- Regulated data that cannot leave your perimeter
- DATA LOCATION
- Your cloud account
On-Premise
Fully air-gapped installation on hardware you control, with an offline update path.
- BEST FOR
- Air-gapped or sovereignty-constrained environments
- DATA LOCATION
- Your data centre
SERVICE LEVELS
What we commit to.
Infrastructure targets and the contractual commitment attached to each.
| METRIC | TARGET | DETAIL | COMMITMENT |
|---|---|---|---|
| Requests / day | 10M+ | Infrastructure sized for high-volume production traffic. | Scales horizontally on demand |
| Voice response | 800ms | Sub-second round trips on real-time conversational systems. | p95 target under sustained load |
| Uptime target | 99.9% | Redundant, monitored deployments with automated failover. | Backed by SLA on Critical tier |
| Regions ready | 4 | Multi-region architecture for latency and data residency. | EU-only residency available |
Standard
- Response
- 1 business day
- Coverage
- Business hours
- Channel
Priority
- Response
- 4 business hours
- Coverage
- Extended hours
- Channel
- Email + shared Slack
Critical
- Response
- 1 hour
- Coverage
- 24/7
- Channel
- Slack + on-call escalation
INTEGRATION
Fits your existing stack.
Identity, logging and provisioning wired into what you already run.
- SAML 2.0 and OIDC single sign-on
- SCIM user provisioning and deprovisioning
- Audit log streaming to your SIEM
- Role-based access control with custom roles
- IP allowlisting and private networking
- Webhook and event-stream integration
- REST and gRPC APIs with signed requests
- Terraform modules for infrastructure-as-code
- Customer-managed encryption keys
PROCUREMENT FAQ
The diligence questions.
If your security review asks something not covered here, ask us directly — we answer in writing.
Can we see your SOC 2 report?
Yes, under NDA. Contact us and we will share the current report along with our latest penetration test summary.
Will you sign our DPA and BAA?
Yes. We have standard GDPR-compliant DPA and HIPAA BAA templates, and we can work from your paper instead if your legal team prefers.
Where is our data processed and stored?
In the region you choose, including EU-only. For VPC and on-premise deployments, your data never leaves your infrastructure at all.
Do you use our data to train models for anyone else?
No. Your data trains your models only. This is contractual, not just policy.
Who are your sub-processors?
We maintain a current sub-processor list and provide advance notice of changes. For on-premise deployments there are typically none.
What happens if we want to leave?
You keep everything. We hand over code, weights, data and documentation in portable formats, and we will support the transition rather than making it difficult.
Let's build something fast.
Tell us what you're trying to ship. We'll come back with a scope, a timeline and a working plan — usually within a week.