Trust & Security
Security at PTAS AI
The controls, named: architecture, encryption, access, deployment models, audit logging, AI governance, retention and incident handling.
The controls
Enterprise AI with control built in
Four controls apply to every product, agent and workflow we ship. They are switched on from the first workflow.
Access control
Role-based access to cases, documents and configuration. Who can see a document, approve a payment or change a rule is set by role.
Encryption
Documents and extracted data are encrypted in transit and in storage. Key management follows the deployment model you choose.
Audit trail
Every agent decision is kept with the values it read, the rule it applied and the result it confirmed, and stays queryable afterwards.
Human review
Low-confidence fields, failed checks and amounts above your thresholds go to a named person. Review is a control, designed in from the start.
Deployment models
Run it where your policy says it has to run
The products and controls are the same in every model. What changes is whose infrastructure they run on and who holds the keys.
Managed by PTAS AI
Cloud
The fastest route to a first workflow. Runs in the region you choose, with access, encryption and audit controls managed by us.
Your cloud account
Private cloud
The platform runs inside a cloud environment you control, so network rules and access policies stay with your team.
Your infrastructure, where supported
On-premise
For organisations whose policy does not allow documents to leave their own systems, including air-gapped setups for regulated workloads.
Data handling
What is kept, what leaves, and for how long
Masking is set per field and per destination. Retention is set by your policy, and every deletion is recorded.
Held internally against exported · Illustrative example
Masking is set per field and per destination, so a KYC reviewer and a billing system receive different versions of the same record.
Documents and the data extracted from them are held for the period your retention policy specifies, then removed, with the deletion recorded against the case. Field-level redaction on export is available for identity data and for any other field you classify as sensitive, so a KYC reviewer and a billing system can receive different versions of the same record.
Files uploaded to the public DocPro test are processed to run the extraction and stored on PTAS AI infrastructure for the test and quality review. They are not public and are not used to train models. Use a document you are entitled to share, and mask anything you must.
AI governance
Nothing acts until it has been checked
Every agent runs the same five steps. A field that fails at any one of them stops there and goes to a person, with the reason attached.
Confidence, validation, review, audit, action
- 01 Confidence Every field scored on its own
- 02 Validation Checked against your rules and records
- 03 Human review Below threshold, a person decides
- 04 Audit What was seen, applied and done
- 05 Action Only then, within the permissions given
Human review is a control, not a failure. The threshold that sends a field to a person is yours to set, per field and per document type.
Bounded agents
Each agent has one job and only the permissions that job needs. It cannot act outside the integration your IT team approved.
Versioned rules
Thresholds and policies are configuration with an owner. Every change records who made it and when.
No silent guesses
A value the agent cannot read confidently is sent for review, never filled in quietly.
Audit logging
A record your auditors can query
A log line saying an invoice posted is not evidence. The record shows what was read, which rule allowed it and what the system confirmed.
One decision, kept in full · Illustrative example
This is what separates an agent from an automation: it can tell you why, months later, without anyone reconstructing it.
Compliance posture
Aligned, and we say aligned
Our security practices are aligned with ISO/IEC 27001 and our delivery practices with ISO 9001. We design for GDPR readiness where our customers process EU personal data. We do not hold certification for any of these standards, and nothing on this site should be read as saying we do.
We would rather show your security team the controls than show them a badge. If your review needs evidence for a specific control, ask, and an engineer will walk through how it works in the deployment model you are considering.
Incidents and reports
When something goes wrong
If an incident affects your data, we notify you through the contacts named in your agreement, within the timeline that agreement sets. The notice says what happened, what was affected and what we have changed so it does not happen again.
To report a vulnerability or a security concern, email connect@ptasai.com with Security in the subject. Include what you found, where, and how to reproduce it. A person reads every report, and we will keep you informed while we investigate.
FAQ
Questions security teams ask
Is PTAS AI ISO 27001 certified?
No. Our security practices are aligned with ISO/IEC 27001, and our delivery practices with ISO 9001, but we do not hold either certification and we do not claim to. We are glad to walk your team through the controls themselves.
Where is our data stored?
In the deployment you choose: cloud in the region you select, a private cloud account you control, or on-premise where supported. Documents and extracted data stay inside that boundary.
How long do you keep documents?
For the period your retention policy sets. After that they are removed and the deletion is recorded. Documents uploaded to the public DocPro test are handled as described on that page.
Do you train AI models on our documents?
Customer documents are processed to do the work you have configured. Files uploaded to the public DocPro test are not used to train models. Any other use of your data is set out in your agreement, and we do not go beyond it.
Can you complete our security questionnaire?
Yes. Send it to connect@ptasai.com with Security in the subject. An engineer who knows the platform answers it.
How do I report a vulnerability?
Email connect@ptasai.com with Security in the subject and enough detail to reproduce the issue. A person acknowledges the report, and we keep you updated while it is investigated.
Keep reading
Related reading
Human-in-the-Loop AI
How review thresholds work and why review is a control.
Read more →Our Approach
What we will not automate, however a project is scoped.
Read more →Agentic AI Platform
Where agents are composed, bounded and audited.
Read more →Test Your Document
Try DocPro on one sample, with the file handling stated up front.
Read more →Security review
Bring your questionnaire
Send your security or vendor-risk questions and an engineer who knows the platform will answer them, for the deployment model you are considering.