Home/Trust center
What a procurement team needsThe architecture is the argument.
With local-only models, no outside AI provider sees a page; with a cloud model configured, the provider sees only the pages you send it. No certification is issued yet — this page says where each one stands.
In: signed releases. Out: only what you configure.
With local-only models (models.localOnly), no outside AI provider sees a page; with a cloud model configured, the provider sees only the pages you send it.
Model providers
With local-only models, none sees a page; with a cloud model configured, the provider sees only the pages you send it.
Licence
A signed file, checked locally. No call home to keep running.
Training
Corrections calibrate your deployment and export as a training dataset for a model you own. Nothing you run trains anything of ours.
PII and PHI
Packs carry masking defaults for sensitive fields. Agents inherit your access rules.
Your region. Your rules.
One core, three separate editions. Each shows only its own region's rules.
Only its own rules
Regulations, legal bases and controls are filtered to the edition.
Its own keys and data
Separate from the other editions, deployed in its own region.
Other regions refused
A client from another region belongs in that region's edition.
One sign-in. Clear roles. Two people.
Who can do what is named, time-limited and sealed — never a shared key.
- Temporary access ends on its own
- Every access change sealed
- Access reviewed every 90 days
What is issued, and what is not.
Nothing below is issued yet. Each item, its real status, and what you can have today.
| Item | Status | What you can have now |
|---|---|---|
| SOC 2 Type I | Not yet issued | Readiness plan and controls description. Auditor not yet engaged. |
| SOC 2 Type II | Not yet issued | Controls description. No observation window open yet. |
| ISO/IEC 27001 and 42001 | Not certified | Control library mapping, on request. |
| GDPR / UK GDPR | Applies by design | In your VPC or air-gapped, the runtime processes personal data in your systems; on gothink Cloud, in your own tenant and region. |
| HIPAA | Planned | No business associate agreement template or PHI-specific controls yet. |
| Penetration test | Planned · scope written | Scope document, on request. |
| DPA and subprocessor list | In preparation | Current draft, on request. |
| SBOM and release checksums | Available | With every release. |
A Type II needs a real observation window. We will not imply it has started. Meanwhile, at Enterprise and Sovereign your documents were never in our environment.
Your questionnaire, completed
Send yours; it comes back completed, not scheduled.
Request →DPA and subprocessors
Current draft, with counsel. With local-only models, no subprocessor sees a page.
Request the DPA →Architecture and data flow
What crosses in, what never crosses out.
Architecture reference →Controls description
Control by control against SOC 2, with the readiness plan.
Request →Penetration test scope
Scope and current status, under NDA.
Request the scope →Escrow terms
Draft term sheet, Enterprise and Sovereign. No agent appointed yet.
Ownership and escrow →What you own, when an engineer asks.
Which base model?
The bundled local model is Qwen2.5-7B-Instruct (Apache-2.0), pinned and checked by checksum.
What format?
Configuration as readable JSON, calibration as a model file, corrections as JSONL with a manifest.
Runs elsewhere?
Your correction data exports as a training dataset for a model you own, run wherever you choose.
gothink keeps the platform, pipeline source, base schemas and pack IP. The full schedule
Failure modes travel. Data does not.
We learn from how the pipeline behaves, never from what passed through it.
- Behaviour signals are opt-in, per deployment, reversible
- Counts and categories, never content
- Written to a local log first, so you can read and block it
None touch your documents.
The list below covers gothink's own corporate operations only. A cloud model provider you configure sees only the pages you send it.
| Purpose | Subprocessor | Your documents or fields? |
|---|---|---|
| Your documents, fields, lineage | None | Local-only: never leave your boundary |
| Support ticketing and email | Named in the DPA pack | No — correspondence only |
| Source hosting and release signing | Named in the DPA pack | No — gothink code only |
Releases, disclosure and support.
Signed, offline-capable
Every release is a signed bundle with an SBOM, air-gapped included.
Supported versions
Vulnerability disclosure
Access to your environment
Only accounts you provision and revoke, with your logging. No standing access after onboarding.
Penetration testing
Planned; scope written. Status shared on request, under NDA.
Every finding closed
Critical to Low, each pinned by a regression test.
Receipt signing minimum
Require a signing level, up to a key in your cloud KMS. Rotated keys stay verifiable.
Legal entity
Named, with jurisdiction and registration, in the order form and DPA pack.
Report a vulnerability
sundar@gothink.ai
Contact →Bring your security questionnaire.
It comes back completed, with the architecture reference and the controls description.