05 / Security & Trust Anchored by FIG.03 + FIG.05

The page your procurement team can forward.

LGPD posture, data residency, sub-processors, incident response, and human-in-the-loop escalation.

//Posture summary

Where we stand today.

Zyron operates ISO 27001-aligned controls across code, runtime, and data handling. SOC 2 Type II engagement is targeted — founder to confirm auditor and target date. LGPD posture is production-live via Dentflow and Barberflow; the same posture ships with every custom system.

LGPD · Production-live ISO 27001-aligned controls SOC 2 · engagement targeted Q4 2026 (pending founder confirmation)

//Data flow & residency

Residency is the shape, not a footnote.

A Brazilian dataset never crosses into a US region and vice versa. Every model call runs under a zero-retention contract with the provider, and every response comes back with citations that point to the exact source chunk.

Zyron data flow with residency and governance boundaries FIG.03 / DATA FLOW · GOVERNANCE · RESIDENCY RESIDENCY: BR REGION (sa-east-1 · São Paulo) RESIDENCY: US REGION (us-east-1 · Houston rack) 01 · SOURCES Private docs · BRHR files · CLT · eSocialpolicies · tickets · calls Structured · BRTOTVS · Senior · ProtheusCDC via Fivetran / native Private docs · USSOP · policies · runbooksConfluence · Drive · SharePoint Structured · USSalesforce · Workday · SAPCDC · warehouse mirror 02 · INGEST · REDACT · CHUNK PII redaction · CPF / RG / CNPJ · tenant-scoped chunking policy engine tags every chunk with tenant_id, residency, classification, retention chunk never leaves BR region · encrypted at rest (AES-256, KMS per tenant) PII redaction · SSN / EIN · tenant-scoped chunking policy engine tags every chunk with tenant_id, residency, classification, retention chunk never leaves US region · encrypted at rest (AES-256, KMS per tenant) 03 · INDEX Vector + BM25 (BR) embeddings pt-BR · pgvector · per-tenant namespace · row-level tenant filter Vector + BM25 (US) embeddings en-US · pgvector · per-tenant namespace · row-level tenant filter 04 · RETRIEVE · RERANK · ASSEMBLE PROMPT Prompt assembler · tenant-scoped · locale-scoped · citation-preserving policy check → retrieval → rerank → context window build → citation index → dispatch 05 · MODEL CALL (zero-retention contract) Provider call · no training on tenant data · region-pinned endpoint · response returns with citations[] → audit log
//Data handling

Encryption, key management, retention.

  • Encryption at rest. AES-256 with HSM-backed KMS per tenant. Keys rotate on a defined schedule and on demand.
  • Encryption in transit. TLS 1.3, mTLS between control plane and runtime, certificate pinning on client-side surfaces.
  • Key management. Tenant-scoped keys, HSM-backed, no cross-tenant key material access. Key custodians are named in the DPA.
  • Retention. Audit log 7 years (LGPD / SOX default). Working-set retention configurable per tenant. Right to erasure honored under LGPD Art. 18.
//Sub-processors

Who else touches the data.

Named list of sub-processors. Full DPA available on request.

  • Anthropic · Model provider · zero-retention contract · us-east-1 + sa-east-1 regions
  • OpenAI / Azure · Model provider · zero-retention contract · US region for US tenants
  • AWS · Managed regions us-east-1, sa-east-1 · Bedrock optional for BR-residency workloads
  • GCP · Auxiliary compute for embedding + rerank workloads · US region
  • Netrality · Colocation facility · 1301 Fannin, Houston TX · owner of the physical facility only

Sub-processor changes trigger 30-day advance notice to enterprise customers per DPA.

//LGPD · Postura brasileira

LGPD posture · in Portuguese where it matters.

A Zyron atua como operadora dos dados pessoais processados pelos sistemas que constrói; o controlador é o cliente. Base legal padrão: execução de contrato (Art. 7º, V). Consentimento (Art. 7º, I) é utilizado quando o fluxo específico exige — por exemplo, comunicações WhatsApp com pacientes (double-opt-in explícito e revogável).

  • Direitos do titular. Workflow completo para acesso, correção, apagamento, portabilidade e revogação de consentimento. SLA: resposta em até 15 dias corridos.
  • Retenção default. Log de auditoria: 7 anos. Dados operacionais: configurável por tenant, com apagamento sob demanda respeitando obrigações legais residuais.
  • Encarregado (DPO). Nomeado no DPA. Contato via canal de segurança abaixo.
//Hallucination mitigation

Grounded, cited, gated.

Zyron systems do not answer ungrounded questions on regulated topics. Every response on labor law, medical, financial, or legally consequential topics ships with citations to the source chunk that grounded the answer, or routes to a human by policy.

  • Retrieval grounding. Every claim answer traces to a retrieved chunk. No chunk, no answer.
  • Citation requirement. Regulated-topic responses include inline citations — the reviewer can open the source document.
  • Confidence threshold. Below tenant-configured τ, the agent stops and escalates. See FIG.05.
  • Policy triggers. Payments, CLT/labor questions, PII output, or user request for a human all trigger escalation regardless of confidence.
//Escalation & audit

Human-in-the-loop is a diagram, not a phrase.

Every escalation ships a full context bundle to the reviewer in under 200ms — transcript, tools, retrieved documents, model reasoning, proposed draft, and the reason confidence dropped. Every decision writes back to the audit log.

Zyron human-in-the-loop escalation workflow FIG.05 / HUMAN-IN-THE-LOOP · ESCALATION · REVIEW · WRITEBACK 01 · CONFIDENCE GATE Confidence & policy gate score ≥ τ → auto-respond score < τ → escalate Also triggers escalation: — high-stakes action (write $) — PII / regulated content — CLT / labor-law answer — unknown tenant policy — user requests human — repeated tool failure 02 · CONTEXT BUNDLE Reviewer context bundle assembled in ≤ 200ms · deep-linked to source — full conversation transcript — tool calls made · args · returns — retrieved documents (top-N) — model reasoning trace — confidence + why it dropped — proposed answer (draft) — policy hits (which rule fired) — similar past cases + prior decisions reviewer decides in seconds, not minutes 03 · REVIEWER DASHBOARD Operator dashboard queue view · SLA timer · assignment Approve draft Edit & send Reject · reply manually Escalate to Zyron reviewer role: client staff (default) · or Zyron on-call Zyron on-call answers in PT-BR + EN, from two-country rotation 04 · OUTCOMES User receives reviewed answer reviewer identity not shown to end user SLA target: ≤ 90s median · ≤ 5min p95 Audit log records everything who reviewed · what changed · why exportable · retention 7y Feedback loop edits become eval cases · policy refined threshold τ retuned per topic + tenant
//Incident response

What happens when something goes wrong.

  • Detection. OpenTelemetry traces, SIEM feed, per-tenant alerting. Anomaly detection on latency, error rate, and escalation-rate deltas.
  • On-call. Two-country rotation, Houston (US) and Vitória (BR). PT-BR + EN response.
  • Data breach notification. Under LGPD Art. 48, ANPD and data subjects notified within reasonable timeframe. Enterprise DPA specifies contractual SLA (typically 72 hours).
  • Post-mortem. Blameless, published to affected tenants within 10 business days.
//Vendor survival

What happens if Zyron does not.

A serious enterprise buyer asks this question. We answer it in the contract, not on this page — but the shape of the answer is here so procurement can plan around it.

  • Source-code escrow. Available on request for enterprise contracts.
  • 90-day data-export guarantee. If Zyron ceases operations, the client retains 90 days of full export access to raw data, embeddings index, and audit log.
  • NDA-able runway disclosure. Enterprise procurement teams can request quarterly runway and financial-health disclosure under NDA.
//Security contact

For disclosure and procurement.

Security disclosures, DPA requests, and procurement / InfoSec inquiries route through the contact page with a security-specific path.

Security path on Contact page

Want the DPA and sub-processor list? Ask.

Talk to us