Operational data is some of the most sensitive data in your business. We treat it that way. Our security and governance practices are designed for regulated, audit-heavy environments, even when the engagement is not regulated.
Processing standards
The single most common question we get from CIOs and CISOs is about AI processing. Our answer is direct: we do not rely on external AI models for processing sensitive client data. All analysis is performed within controlled and secure environments with strict data-governance principles.
Standard / 01
We do not rely on external, public, or third-party AI models for processing sensitive client data. All analysis is performed within controlled and secure environments with strict data-governance principles.
Standard / 02
Process-mining transformations, queries, and reporting run inside governed environments, either Alkhai's own SOC-aligned environment or a client-controlled tenant where required.
Standard / 03
Data minimization, purpose limitation, retention boundaries, and disposal procedures are documented and reviewed for every engagement.
Standard / 04
Because every finding traces to specific events, our outputs themselves serve as defensible process evidence in regulated environments.
Data security
These are baseline, not premium tier. They apply to every engagement, regardless of size or industry.
Alkhai deploys inside your own tenant, private cloud, or VPC and reads event data in place, read-only. Nothing is copied out or sent to a third party.
Role-based access control with JWT-based authentication. Every action is authenticated, scoped to a role, and least-privilege by default.
Each client's data is isolated at the tenant boundary. No cross-tenant access, ever, enforced in the architecture, not by policy alone.
Personal data is masked, hashed, or excluded by default. We work with the minimum data required to answer the operational question, no more.
Every transformation, query, and export is written to a hash-chained, tamper-evident log. Any change to the record is detectable.
All data in transit is encrypted with TLS 1.2+. All data at rest is encrypted with AES-256 in customer-controlled storage where required.
We provide a full security questionnaire response and DPA on request, including subprocessor list, data-flow diagrams, and incident-response procedures.
Explainability & evidence
For regulated buyers, a recommendation you can't defend is a liability. Alkhai is built so that every finding carries its own evidence chain, all the way back to the underlying events.
Each recommendation traces back to the exact events behind it. There are no black-box conclusions, you can follow any number to its source.
Reconstruct any past pipeline state to see exactly what the data showed and what was recommended at that point in time.
Because every finding is evidence-linked, the outputs themselves serve as defensible process evidence in regulated environments.
The Alkhai engagement
Connect your event data. Within 30 days we deliver your top 5 bottlenecks with ROI attached to every fix. From there it becomes your standing monthly operational intelligence review.
By day 30
Every month after
