Trust & Security
Engineered in Hamburg for regulated life-sciences teams. Certified, isolated, and hosted exclusively in the European Union.
Security architecture
Isolated tenant database & storage
Each customer runs in an isolated PostgreSQL database and dedicated cloud storage containers over private VPC networking.
Role-based access & SSO
Project-level permissions ensure confidential clinical and regulatory documents are only visible to authorized team members, with optional Microsoft Entra ID SSO.
TLS 1.3 & AES-256 encryption at rest
All traffic is encrypted via TLS 1.3 and IPsec VPN tunnels; documents, vector indexes, and vaulted backups are encrypted at rest with AES-256.
Full traceability & audit trails
Every prompt, agent action, source document version, and Word export is logged with timestamps and user attribution.
ISO/IEC 27001:2022
Certified Information Security Management System (ISMS)
Pharos Labs operates an independently DQS-audited ISO/IEC 27001:2022 ISMS covering software engineering, cloud operations, incident response, and vendor governance for Regulaido. The certificate and Statement of Applicability are available on request:
- DQS ISO 27001 Certificate (PDF)
- Statement of Applicability (SoA)
- Security & GxP Architecture Whitepaper
- EU Sub-Processor & ZDR Register
Auditability & human control
Source lineage & page-exact citations
Every generated claim links directly to the highlighted passage in the underlying PDF or CSR table.
Version history & tracked revisions
Every Word and XML edit creates an inspectable revision with before/after diffs and completeness checks.
Expert sign-off & human-in-the-loop
Agents never finalize a submission autonomously. Medical writers review and approve every output.
EU AI Act & HTACG
Low-risk classification
Expert-operated documentation software with mandatory human review, outside Annex III high-risk clinical device categories.
JCA disclosure logs
Automatically records model versions, prompts, and screening steps required for EU Joint Clinical Assessment submissions.
Zero model training
Contractual and technical zero-data-retention on all LLM inference calls. Customer files never train any model.
Sub-processors
| Sub-processor & Services | Role | Location | Assurance |
|---|---|---|---|
Google Cloud EMEA Ltd. Cloud Run, VPC & Document AI OCR | Application & worker compute, EU OCR processing | Netherlands (europe-west4) & EU | ISO 27001 · SOC 2 · BSI C5 |
Microsoft Ireland Operations Ltd. Azure PostgreSQL 18, Blob Storage, Key Vault & Entra ID | Database, encrypted blob storage, vaulted backup & SSO | Sweden Central (EU) | ISO 27001 · SOC 2 · BSI C5 |
Enterprise Vertex AI & Azure OpenAI Zero-Data-Retention LLM Inference | Stateless document & literature processing | Sweden Central & europe-west4 | No training on customer data |
Need our ISO 27001 certificate & security package?
Bring an SLR protocol, a house Word template, or a dossier section. In 30 minutes we will run it live and answer your questions on workflows, EU hosting, and rollout.
“Tell me which dossier, literature review, or Word template is eating your team’s week. We’ll test it live together.”
