Cermelo
Book a demo ↗
SECURITY

Your data stays
where it belongs.

Cermelo is built so that you can prove AI savings without handing over your prompts, your customers' messages or your API keys.

Stated plainly: Cermelo holds no security certifications yet. This page separates what is built into the product today from what is on our roadmap.
01 / COMPLIANCE ROADMAP

Built for scrutiny.
Certification on the way.

Each item shows its real status. "Built in by design" describes how the product works today; "Planned" means not yet achieved.

Built in by design

GDPR

Cermelo is built to collect as little as possible: the gateway stores metadata and a keyed fingerprint instead of prompt text (a provider's error message is kept and can quote part of a request); uploaded logs are analyzed in memory and not kept; quality tests can run entirely inside your environment, while free-text tests run from the dashboard keep a small sample of questions and answers for your own blind grading. Our database is hosted in the EU (Ireland). For pilots involving personal data, we sign a data processing agreement before any data is shared.

Planned

EU AI Act

Cermelo measures and routes AI model calls to reduce cost; it does not make decisions about people. We plan a documented assessment of which EU AI Act obligations apply to Cermelo, and will publish the outcome here.

Planned

ISO 27001

We plan to build and certify an information security management system against ISO 27001, the international standard for managing information security.

Planned

ISO 42001

We plan certification against ISO 42001, the international standard for responsible management of AI systems.

Planned

SOC 2 Type II

We plan an independent SOC 2 Type II audit, which tests that security controls work consistently over a period of time, not just on one day.

02 / DATA FLOW

What we see depends
on how you connect.

Three ways to work with Cermelo, described precisely. Where prompts must never leave your company, use the evaluation runner.

RoutePasses through CermeloStored by CermeloStays with you
Evaluation runnerquality testingOnly the results file, if you choose to share itRight/wrong per example, token counts, latency, configuration settings, hashes of system promptsPrompts, answers, examples and API keys
Uploaded logscost analysisThe file you upload, analyzed in memoryThe resulting report onlyEverything you don't export. You choose the columns.
Cermelo gatewaycost analysis, shadow testsPrompts and answers in transit, because the gateway forwards them to the model providerMetadata, a keyed prompt fingerprint and, for failed requests, the provider's error message; never the prompt textTraffic you don't route through it. The gateway holds the provider API keys.
03 / BUILT IN TODAY

Privacy in the product,
not only in the policy.

What the product already does, today.

Metadata, not message content

The gateway stores metadata: model, tokens, latency, cost, status and a keyed fingerprint of each prompt, not the prompt or the answer. A failed request also keeps the provider's error message, which can quote part of the request. One deliberate exception: free-text tests run from the dashboard keep a small sample of questions and answers so you can grade the judge blind. Run tests with the model-test kit to keep all text on your side.

Evaluation inside your environment

Our evaluation runner is a single file you run on your own systems with your own API keys. It returns right/wrong per example, never text, and Cermelo refuses any results file that contains more.

Uploaded logs are not kept

Log files you upload for cost analysis are analyzed in memory. Only the resulting report is saved.

EU data region

Our database is hosted in the EU (Ireland).

No training on your data

Cermelo does not train or fine-tune AI models, on your data or anyone else's.

Closed access by default

Every dashboard request requires a login. Access is by invitation, you choose your own password from the invitation e-mail, and database tables are closed to direct public access.

Customers kept apart twice

Each customer's data is separated by the application and, independently, by the database itself: every request runs as a restricted database role that can only see and change your organization's rows.

Encrypted connections

Connections to model providers and to our database are encrypted, and stored data is encrypted at rest by our database provider.

04 / FAQ

Questions we expect
from your security team.

Is Cermelo certified?

Not yet. Cermelo is an early-stage company. ISO 27001, ISO 42001 and SOC 2 Type II are on our roadmap, together with a documented EU AI Act assessment. This page will say so the day any of them is achieved, not before.

Can we test Cermelo without sharing prompts or customer data?

Yes. The evaluation runner runs inside your environment with your examples and your API keys. You can open the results file it produces and check that it contains no text before you share it.

Where is our data stored?

In our database in the EU (Ireland). What we store depends on how you connect: metadata and reports, not message text, except a small sample of questions and answers when you run free-text tests from the dashboard. The data flow table above shows exactly what applies to each route.

Do you use our data to train AI models?

No. Cermelo does not train or fine-tune AI models.

What happens to our data if we stop using Cermelo?

An admin of your organization can export everything we store for you, and delete all of it, under Your data in the dashboard. We also do it on request.

Will you sign a data processing agreement?

Yes. For pilots involving personal data, we sign a data processing agreement before any data is shared.

SERIOUS ABOUT SECURITY?

Ask us
anything.

We would rather answer your security team's hardest questions before a pilot than after.

Book a demo ↗