Autonowmy ships into BFSI, telecom, healthcare, and regulated industries. This page is what we send your security team — so they don't have to ask.
Audit window opens Q1 2026. Report target Q2 2026. Type I letter available now under NDA.
Target: Q2 2026Stage 1 audit complete. Stage 2 scheduled for Q2 2026. Statement of Applicability available under NDA.
Target: Q3 2026DPA provided at procurement-time. Standard contractual clauses on file. EU data residency available.
LiveCompliant by design for our Noida-based engineering. Data fiduciary registration on file.
LiveBAA available for healthcare customers under our single-tenant deployment. Targeted attestation Q4 2026.
Target: Q4 2026We don't store or process cardholder data ourselves. Agents that touch PCI environments deploy single-tenant in-scope.
Scope: agent-onlyModerate baseline targeted with our US Federal launch partner. Sponsor identified. Expect 2027.
Target: 2027Our autonomy-dial governance is mapped to NIST AI Risk Management Framework controls. Mapping doc on request.
LiveAll three honor the same trust model, same audit trail, same autonomy dial. The difference is where the data sits and who runs the runtime.
Hosted by Autonowmy on AWS. Logical tenant isolation, per-tenant keys, in-region residency. Fastest time-to-value — production in two weeks.
Your own dedicated AWS account or Azure subscription. Same software, same release cadence — physically isolated. Standard for BFSI and healthcare.
Run Autonowmy on your own Kubernetes — AWS, Azure, GCP, on-prem. Air-gapped operations supported. For sovereign and air-gapped customers.
Below is our complete sub-processor list as of May 2026. We notify customers 30 days before adding any new sub-processor.
| Provider | Purpose | Region |
|---|---|---|
| Amazon Web Services | Primary infrastructure | us-east-1, eu-west-1, ap-south-1 |
| Microsoft Azure | Single-tenant deployments (optional) | customer-elected |
| Anthropic | LLM inference (default) | us, eu (via AWS Bedrock) |
| OpenAI | LLM inference (optional) | us, eu (via Azure) |
| Datadog | Observability (internal) | us |
| Sentry | Error tracking (internal) | us |
| Stripe | Billing | us |
| Linear | Internal issue tracking | us |
Sub-processor changes notified 30 days in advance to security-notify@ of record. Request the latest copy →
All connections, internal and external. Mutual TLS for inter-service communication.
Customer-managed KMS supported. Key rotation on demand.
Okta, AzureAD, Google Workspace. Group-based RBAC. MFA required for dial step-ups.
Every reasoning step, tool call, and approval signed. Replayable forever.
Independent firm. Latest report available under NDA on request.
security@autonowmy.com · 24h triage SLA · safe harbor for researchers.
Materially impactful security incidents notified to customer security contact within 60 minutes.
Standard for anyone with production access. Renewed every two years for access role-holders.
We have answers to most of them already drafted. Standard CAIQ, SIG, and HECVAT responses on file. Send the questionnaire — we'll respond within three business days.