Security model.
Raven is built for institutions that cannot afford soft answers about security. This page documents the controls every customer can rely on by default.
Encryption
- In transit — TLS 1.3 with modern cipher suites. Older protocols are disabled across all surfaces.
- At rest — AES-256 with envelope encryption. Keys are managed by AWS KMS, GCP KMS, or Azure Key Vault depending on deployment.
- Customer-managed keys — available for Customer Cloud and on-prem deployments. We never see your data keys.
Identity & access
Every action on Raven is performed in the context of a verified identity. Anonymous or system-only access is not supported.
- SSO via SAML 2.0 and OIDC.
- SCIM 2.0 for automated provisioning and de-provisioning.
- Hardware-key MFA enforced for admin roles by default.
- Short-lived tokens (default 1 hour) for service identities.
Audit & accountability
Every read, write, decision, and action is logged. Audit records are signed and stored in append-only storage. Customers can stream audit events to their own SIEM in real time.
What we log
- API calls, including the full request and response shape.
- Reasoning steps in Huginn, including model calls and citations.
- Sleipnir workflow executions, with input, decision points, and output.
- Identity events: logins, role changes, key rotations.
Tenant isolation
Customer workloads are isolated at every level of the stack: separate accounts/projects in cloud deployments, separate logical workspaces in shared infrastructure, and separate cryptographic boundaries regardless of deployment mode.
Regulatory alignment
Raven is designed against the regulatory environments our customers operate in — across the EU, the US, the UK, and beyond. Compliance is built in from day one, not retrofitted to a quote.
European Union
- GDPR — EU/EEA data residency available on request. Data subject rights tooling out of the box.
- DORA — operational resilience controls and third-party risk artifacts ready for financial-sector customers.
- NIS2 — incident reporting, supply-chain controls, and governance documentation aligned with the directive.
- EU AI Act — human-oversight, transparency, and documentation controls built into Huginn and Sleipnir.
- Schrems II — cross-region data transfer paths off by default.
United States
- SOC 2 Type II — annual audit, public report on request.
- HIPAA — BAA available for healthcare deployments.
- FedRAMP-friendly — architecture compatible with the Moderate baseline; in active assessment.
- State privacy laws — CCPA / CPRA, VCDPA, CTDPA, and the rest of the patchwork honored by the same data-residency and consent primitives.
Certifications
- ISO/IEC 27001, 27017, 27018.
- BSI C5 (Germany) — in progress.
- SecNumCloud (France) — in progress.
- ENS (España) — in progress.
- SOC 2 Type II.
- HIPAA available for European healthcare cross-border deployments.
Responsible disclosure
If you believe you have found a security vulnerability in Raven, please contact security@raven.example. We acknowledge reports within one business day, and we recognize responsible disclosure publicly with the reporter's permission.