Security, Data Hosting and AI Controls

Secure by design

Security is not an afterthought bolted onto the product. Because Entelion operates regulated systems and holds your validation records and audit trails, security and GxP data integrity are built into every layer of the architecture from day one.

Data sovereignty and control

Your data stays where you need it. We support EU- and US-based hosting with clear residency guarantees.

One cloud, one region

Entelion runs entirely on AWS, in the region you select. The AI models are invoked through Amazon Bedrock inside that same region, so your documents are never sent to an external model API and never leave your chosen region.

No model training

Model inference runs in-region through Amazon Bedrock under an enterprise agreement: no training on your data, no retention, no cross-customer use. What you put into Entelion stays yours.

Enterprise-grade features

SSO, role-based access control, immutable audit trails, and controls aligned with 21 CFR Part 11 and Annex 11 expectations.

Enforceable commitments

Data protection, incident response SLAs, and controls aligned with SOC 2 guidelines, GDPR, and 21 CFR Part 11 expectations.

Security is Fundamental to Everything We Do

Security is woven into every layer of our platform, from strong authentication controls to continuous network monitoring. We pair advanced technology with strict, GxP-aligned safeguards to keep validation records, audit trails, and regulated system data protected as the threat landscape keeps shifting. We regularly test and refine our defenses, staying a step ahead of emerging risks so our clients can keep trusting us with their data.

Your data is everything you bring into or generate in Entelion: the systems and credentials you connect for validation, the validation documentation Entelion produces, the audit trails behind it, and the related system configurations, user activity and metadata. It does not include the anonymized, aggregated statistics we use to keep the service reliable, which cannot be traced back to you or your systems.

We encrypt your data in transit and at rest. Each customer's data is logically separated, so your validation work is never mixed with anyone else's. Access is governed by role-based permissions, and every action on a record is captured in a time-stamped, attributable, immutable audit trail, with electronic signatures on signed output, supporting data-integrity expectations under 21 CFR Part 11 and EU Annex 11. Our security controls follow SOC 2 guidelines.

Entelion can host your data either in the European Union or in the United States, according to your preference, and your validation data stays in the region you select.

Only the people you authorize. Access is governed by role-based permissions and logged end to end, so every access is attributable and reviewable in an inspection. The credentials Entelion uses to connect to and explore your systems are provided and controlled by you and can be revoked at any time.

No. Your data is used to do your validation work and nothing else. We do not use it to train or improve any AI model, and we never reuse one customer's data inside another customer's account. In a regulated setting, that strict isolation is a requirement, not an option. Entelion generates documentation using leading third-party foundation models, and we require those providers not to retain or train on the data we send them.

Direct access lets Entelion explore a system and do the most, but it is never required. For systems that are not reachable, or that you prefer to keep closed, you run a more traditional, digitised validation process inside Entelion, where the AI still assists and automates an important part of the work. Same platform, same controls, without the automated exploration step.

Built for the most scrutinized industry on earth