Built for trust.Designed for compliance.
GolgAI helps organizations address security, privacy, and regulatory requirements through transparent controls, responsible data practices, and compliance-focused infrastructure.
Global standards
Compliance practices aligned with recognized security and privacy frameworks.
Privacy
Privacy and data protection considerations across the data lifecycle.
Documentation
Compliance and contractual documentation available according to customer and service requirements.
Assurance
Security assessments, audits, and continuous improvement support our compliance approach.
Our compliance approach.
Compliance is not limited to a certification. It involves policies, controls, processes, contracts, data governance, security practices, and continuous improvement.
Compliance Overview
GolgAI is committed to helping customers meet their regulatory and compliance obligations. We design our products and processes to align with global standards while providing transparency and control over how data is handled.
ISO 27001
GolgAI is certified against ISO/IEC 27001:2022, the international standard for information security management systems (ISMS). The certification covers infrastructure, application development, and operational processes. Certificate documentation is available upon request.
SOC 2 Type II
GolgAI undergoes an annual SOC 2 Type II audit evaluating security, availability, and confidentiality controls. The audit is performed by an independent third-party firm. Customers may request the SOC 2 report under a non-disclosure agreement.
GDPR
GolgAI supports privacy and data protection requirements under the General Data Protection Regulation.
- Data Processing Agreement: DPA documentation is available for customers and incorporates applicable Standard Contractual Clauses where required.
- Data subject rights: Support for access, rectification, erasure, portability, and objection requests.
- Data Protection Officer: dpo@golgai.com
- Data residency: Geographic data residency options are available according to the applicable service configuration.
CCPA
GolgAI supports the privacy rights established under the California Consumer Privacy Act. California residents may have rights relating to access to personal information, deletion requests, and applicable opt-out rights. GolgAI does not sell customer personal data.
HIPAA Readiness
GolgAI can support architectures designed around healthcare data protection requirements. Where applicable, business associate agreements (BAAs) may be established with covered entities and business associates. Customers handling protected health information should contact GolgAI to discuss the appropriate configuration and contractual requirements.
PCI DSS
GolgAI uses Stripe for payment processing. Stripe operates under applicable PCI DSS requirements, while GolgAI's architecture is designed to minimize the handling of sensitive payment-card information. GolgAI does not store full card numbers or CVVs in its application environment.
Data Residency & Sovereignty
Data residency and sovereignty are important considerations for organizations operating under regulatory, contractual, or institutional requirements.
GolgAI provides geographic deployment considerations according to the applicable product and infrastructure configuration. Enterprise deployments may also support specific infrastructure requirements, including on-premises deployment where available.
Audit Logging & Retention
GolgAI uses audit and logging mechanisms to support security, operational monitoring, and compliance requirements. Depending on the applicable service, logs may contain user identifiers, timestamps, IP addresses, and action details. Retention and export capabilities may vary according to service configuration and customer requirements.
Third-Party Assessments
GolgAI engages external security and compliance professionals where appropriate to perform penetration testing, vulnerability assessments, and compliance-related reviews. Applicable reports or summaries may be made available to qualified customers under appropriate confidentiality arrangements.
Data Subject Requests
GolgAI supports requests relating to personal data access, export, correction, and deletion where applicable.
For complex requests or cases where self-service mechanisms are not available, customers and data subjects can contact our privacy team at privacy@golgai.com.
Other Certifications
- ISO 27017: Cloud security practices.
- ISO 27018: Protection of personal data in cloud environments.
- FedRAMP: Certification work is currently identified as in progress toward FedRAMP Moderate.
Contracts & Agreements
GolgAI provides contractual documentation appropriate to its services, including Data Processing Agreements (DPA), Business Associate Agreements (BAA), and applicable EU Standard Contractual Clauses. Customers requiring custom contractual arrangements can contact our legal team.
Compliance Inquiries
For compliance questions, audit requests, documentation, or compliance concerns, contact the appropriate GolgAI team.
Compliance is an ongoing commitment
GolgAI continuously reviews its security, privacy, and compliance practices as requirements evolve. For the latest compliance documentation or a customer-specific compliance package, please contact our team.
Need compliance documentation?
Talk to our team about compliance documentation, audit requests, privacy requirements, or enterprise contractual needs.