# Trust

> Where Sumarity runs and how decisions are controlled and recorded.

Source: https://www.sumarity.ai/trust/

Trust 

# Hosted in Zurich. Checked at every step.

How Sumarity looks after your data and your decisions. If your security team has a questionnaire, send it to us.

Ask for our security pack  

How it's built

## Security and control

| Where it runs | Google Cloud, Zurich (europe-west6). Your data, backups and logs are stored in Switzerland.A dedicated deployment in the EU or in your own cloud is available.
| Numbers | Never from a model.Code works out every amount and date. The validator refuses a workflow that would take a number from a model.
| Changes | Only by publishing.A workflow changes only when an admin publishes a new version. Tuning proposes; people decide.
| Access | Roles, separation of duties, four eyes.Rights by role; no one approves their own work; a second person for material items.
| Records | Every call on record.What the engine saw, how sure it was, which version, who reviewed it. Run reports and an evidence pack per period.
| Backups | Nightly, in Zurich.Database backups each night to storage in Zurich, and daily disk snapshots.
| Infrastructure | Encrypted in transit and at rest.HTTPS everywhere; administrative access only through Google's identity-aware proxy, with no open SSH.  

Certifications

## Our certification programme

| UK Cyber Essentials | For UK customers and their insurers.
| SOC 2 Type I and Type II | Controls examined by an independent auditor.
| ISO/IEC 27001 | Information security management.
| ISO/IEC 42001 | AI management: how AI is governed, measured and overseen.
Each report and certificate is published here when it's issued.

Regulation

## The EU AI Act

Most of Sumarity's work (reconciliation, matching, filings, claims handling) is not a high-risk use under the EU AI Act. A few library workflows can be, when a customer runs them on people: benefit eligibility, the creditworthiness of individuals, and employment checks. Those workflows are marked in the library. For them, Sumarity provides what the Act asks for: human oversight on every uncertain call, a record of every decision, and documentation of how each judgement is checked and measured.

Documents

## Paper for your procurement team

Our terms, data processing agreement and list of sub-processors are sent on request and published here. Report a security issue to hello@sumarity.ai; we reply within one business day.