We run your supply chain. We protect it too.
Emerix reads your documents, connects to your business systems, and acts inside your operations. That level of access raises the security bar, and we built Emerix to meet it.
SOC 2 Type II
GDPR- Annual third-party penetration testing
Why it matters
Security for an AI that works inside your business.
Most software stores your data and shows it back to you. Emerix works with it. It reads the documents your supply chain runs on, connects to your business systems, and takes action on your behalf.
That access is what makes Emerix useful, and it is why security is a first-order requirement in how the product is built, not something added afterward. Everything here follows from one principle: you stay in control of your data, and of every action taken with it.
AI and data governance
AI you can put in production.
The real question about an operational AI is not whether it works, but whether you can trust it with access.
A human approves every action
Emerix proposes; a person decides. Every AI-proposed action requires explicit human approval before it executes. A person is always in the loop.
Your data never trains a model
Customer data is never used to train foundation models and is never shared with model providers. It is sent for inference and nothing else. Anything Emerix learns for you stays scoped to your account, is never generalized across customers, and is removed when your contract ends.
Enterprise model hosting
Our language models run on AWS Bedrock, Google Vertex AI, and Azure AI Foundry. Your data is sent for inference only and is not retained by the provider.
A record of every decision
Every suggestion Emerix makes, and every human decision on it, is recorded. You get a complete account of what was proposed and what was approved.
Data and infrastructure
Built on 
Emerix runs on Amazon Web Services. AWS data centers provide 24/7 physical security, continuous monitoring, and independent certification against the standards enterprises rely on.
- Data residency configurable on request
- Encrypted in transit and at rest
- Isolated per customer
- SOC 1 / 2 / 3Service organization controls
- ISO 27001Information security management
- PCI DSS Level 1Payment-data security
- FedRAMPU.S. federal authorization
- HIPAA-eligibleHealthcare data handling
Encryption and key management
Customer data is encrypted at rest with AES-256 and in transit with TLS 1.2 or higher, on internal and external traffic alike. Keys are managed in AWS KMS and rotated automatically each year, backed by FIPS 140-2 validated hardware security modules. Application credentials and integration tokens live in a managed secrets store, never in source code.
Network isolation
Production runs inside private Virtual Private Clouds, isolated from non-production environments and the public internet. Public ingress is limited to expected endpoints on expected ports.
Infrastructure as code
Every part of our environment is defined and deployed as code. Configuration is version-controlled and continuously monitored and updated.
Continuous monitoring and threat detection
Managed threat detection watches for anomalous and malicious activity, and continuous vulnerability scanning covers workloads and container images. Findings are triaged and remediated as part of ongoing operations.
Security in depth
Secured at every layer.
Application security
Secure development lifecycle
Every feature is scoped and architecture-reviewed before it is built. All code, including infrastructure code, is peer-reviewed before it merges, with dedicated security review when a change warrants it.
Containerized, isolated workloads
Emerix runs as independent, containerized services, each with least privilege. The blast radius of any single component stays contained.
Vulnerability prevention
A strict Content Security Policy defends against cross-site scripting and markup injection. Parameterized, access-controlled queries prevent SQL injection. An API-first design with clean front-end and back-end separation keeps whole categories of application-logic flaws out of production.
Data-layer tenant isolation
Customer data is isolated per tenant at the storage layer, not by application logic, with separate access controls for each tenant. One tenant’s credentials cannot reach another tenant’s data.
Enterprise identity and access
Powered by WorkOSSingle sign-on
SAML and OIDC with any major identity provider, including Okta, Microsoft Entra ID, Google, and Ping.
Automated provisioning
SCIM directory sync provisions and deprovisions users automatically from your directory, so access always tracks your source of truth.
SIEM audit streaming
Security and access events stream to your SIEM.
Administrative access
Internal administrative access to production runs over controlled, authenticated channels and requires multi-factor authentication.
Operational security
Endpoint and access controls
Employees work on company-managed, encrypted, continuously patched workstations. Internal access follows least privilege: people get only the access they need.
Email security
Emerix email runs on Google Workspace. We publish a strict DMARC policy, so messages from an Emerix domain cannot be spoofed.
Security awareness training
Every employee and contractor completes annual security awareness training covering phishing and social engineering, credential hygiene, data handling, and privacy.
Incident response
A documented incident response plan with defined procedures for prompt customer notification.
Security at a glance
Everything your security team needs for a vendor assessment, in one place.
- Compliance
- SOC 2 Type II · GDPR · Google CASA
- Data residency
- United States; other regions on request
- Encryption in transit
- TLS 1.2+
- Encryption at rest
- AES-256
- Key management
- AWS KMS, automatic annual rotation (FIPS 140-2 HSMs)
- Identity
- SSO (SAML/OIDC), SCIM provisioning, SIEM audit streaming via WorkOS
- Tenant isolation
- Per-tenant isolation at the storage layer, with separate access controls for each tenant
- AI model hosting
- AWS Bedrock, Google Vertex AI, Azure AI Foundry; no training on customer data
- Monitoring
- Managed threat detection; continuous vulnerability scanning
- Testing
- Annual third-party penetration test; CASA SAST + DAST
- Incident response
- Documented IR plan with prompt customer notification
- Security contact
- SOC 2 report, DPA and vulnerability reports: [email protected]
Let’s discuss your workflows.
See where Emerix fits in your operation, on your own data.