Security posture, stated precisely.

We say what is enforced, what is contractual, what is designed, and what is roadmap — and we never blur the four.

Your prompts and your alpha

Contractual: Zimax inference runs on Azure AI Foundry (“Models sold by Azure”). Under Microsoft's documented data-privacy commitments, customer prompts, completions, and embeddings are not available to model providers and are not used to train foundation models by default — and never without the customer's explicit instruction. The models are stateless: prompts and completions are not stored in the model.

Enforced: our inference gateway's usage accounting explicitly disables prompt storage in spend logs. What we meter is tokens, not content.

Stated honestly: Azure's default abuse-monitoring may retain flagged content for up to 30 days for human review. Microsoft's Zero Data Retention configuration (“modified abuse monitoring”) requires an approved, account-managed relationship — we are pursuing it and will not claim it until granted.

Isolation is enforced, not promised

  • Every tool call crosses an Open Policy Agent check that fails closed — if the policy engine is unreachable, the request is denied.
  • The tenant identity in the verified token must equal the tenant in the request; vector-store filters are injected server-side and are keyed to the token, never to client input.
  • Document clearance participates in every decision: effective clearance is the maximum of caller and document, so a permissive caller cannot unlock a restricted document.
  • Every allow and deny — including which rule fired — is written to a decision log.
  • Edge TLS is 1.3-only with a restricted cipher suite; per-IP rate limiting is enforced at the edge and verified by smoke test.
  • Off-site backups are write-once (WORM): a locked, time-based retention policy that we verified by attempting a deletion and having Azure refuse it.

Certified vs. designed — the honest ledger

We do not hold SOC 2, ISO 27001, HIPAA, or FedRAMP certifications today, and we will never imply otherwise. Formal audit is on our roadmap and our architecture was built to make it boring.

Designed to support — our clearance ladder (commercial / unclassified / export-restricted tiers), per-document classification, and cloud-egress policy gates were designed against ITAR/EAR and CMMC/NIST control families from day one. Restricted tiers are architecturally present and deliberately not yet in service; they activate only when the in-boundary inference hardware and controls that back them honestly exist.

Regional care: our Mexico region is operated with data residency as a first-class constraint, and we treat Mexican data-protection review (LFPDPPP) as a gate on customer onboarding there — not a checkbox after the fact.

Responsible disclosure

Found something? We want to know, and we will treat you well. Disclosure policy · security@zimax.net

Vendor security questionnaire? Send it over — we answer them candidly, including the questions where the honest answer is “not yet.”