Security

Production systems are deployed into your cloud or ours per agreement. AWS, Azure, and GCP are first-class. On-premise and air-gapped variants are available for engagements with classified or sovereign requirements (we have built and validated per-country sovereign deployments; see the Envoy case study).

Where third-party LLM providers are used, the choice is configurable per region and per workload. EU traffic can be routed to EU-hosted inference (Mistral, Azure EU) for GDPR compliance. Provider contracts that prohibit training on customer data are the default.

Least privilege by default. Credentials are scoped to the minimum needed for the engagement, time-bounded, and rotatable. We work through your IAM (Okta, Azure AD, Google Workspace) where available, with SSO and MFA.

Production credentials live in your secret manager (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager) and are accessed via short-lived tokens, never long-lived keys committed to code.

Encryption in transit (TLS 1.2+) and at rest (provider-managed KMS) is the baseline for every engagement. Per-region data residency is enforced architecturally where required, not patched on after the fact.

Logs are retained per agreement and access-controlled. PII handling is documented per data category at engagement kickoff. We do not retain client data beyond the engagement scope; deletion is on schedule or on request.

ONC9 LLC is a Wyoming entity. Engagements are contracted in USD.

Vendor packet available on request, including certificate of incorporation, bank confirmation, references from prior engagements, signed NDA, and security questionnaire responses (CAIQ, SIG-Lite, or your own format). Insurance and certifications scoped per engagement requirements.

For procurement and vendor onboarding inquiries, contact andres@onc9.com. Standard response within one business day.