# Secure AI for associations: SOC 2 and ISO 27001 | ReadyIntelligence > SOC 2 Type II and ISO 27001 certified, built to support GDPR, with US or EU hosting, isolated environments, default-deny permissions and a full audit trail. Source: https://readyintelligence.com/platform/security.html 1. [Home](https://readyintelligence.com/) 2. [Platform](https://readyintelligence.com/platform.html) 3. Security # Security you can take to your board ReadyIntelligence is built for organisations that hold sensitive member data. Here's how it's certified, where your data lives and how permissions keep every answer in bounds. Security at a glance ## Your data, protected at every layer 1. [**01Certified hosting**ISO 27001 and SOC 2 Type II, hosted in the US or EU](#security-certified) 2. [**02Kept apart**Your data sits in its own isolated environment](#security-kept-apart) 3. [**03Permission-aware**Default-deny, so people only see what they're allowed to](#security-permissions) 4. [**04Traceable**A full audit trail of every query and answer](#security-traceable) ISO 27001SOC 2 Type IIGDPR-ready 01 ## Certified and independently audited Security is checked by independent auditors, not just promised, so you have the evidence your board, members and procurement team expect. - ISO 27001 certified - SOC 2 Type II - Designed to support your GDPR obligations - Supporting documentation available on request 02 ## Your data, kept apart Each client runs in its own isolated environment, hosted in the region you choose, and your content stays inside infrastructure we control. - A choice of US or EU hosting, with EU data residency - A dedicated database and storage for every client - Tenant isolation enforced at infrastructure level, not just in settings - Self-hosted search, so your content isn't sent to a third-party embedding service 03 ## Permission-aware, from day one A default-deny model means the assistant only uses the sources you've explicitly connected, and it checks each person's access rights every time they ask. - Each assistant only uses the sources and tools you give it - Every user's access checked at the point of query - Staff actions run under their own permissions - Fine-grained roles for who can manage agents, data and knowledge 04 ## Traceable and accountable Every answer records where it came from and every query is logged, so nothing happens out of sight and your data is never used to train AI models. - Citations back to the exact source behind each answer - A full audit trail of every query and response - Answers only from your content, never the open internet - Your data is never used to train foundation models Keep exploring ## Explore more of the platform - [Usage & cost control See how your AI is used and what it costs, with alerts and hard limits. Learn more](https://readyintelligence.com/pricing/usage-cost-control.html) - [Implementation Start small, connect your AMS or CRM, then expand at your own pace. Learn more](https://readyintelligence.com/pricing/implementation.html) - [Integrations Use your assistant from Claude and other AI apps, with a REST API and single sign-on. Learn more](https://readyintelligence.com/platform/integrations.html) [See pricing](https://readyintelligence.com/pricing.html) ## Related reading [Browse all resources](https://readyintelligence.com/resources/news.html) - [BlogWhy Microsoft Copilot isn't the right AI for your associationSee why not Copilot →](https://readyintelligence.com/resource/why-microsoft-copilot-isn-t-the-right-ai-for-your-association-and-what-is.html) - [BlogYour chatbot sounds confident. But is it right?Check your chatbot →](https://readyintelligence.com/resource/your-chatbot-sounds-confident-but-is-it-right.html) - [GuideHow to choose an AI platform: a buyer's checklistGet the checklist →](https://readyintelligence.com/resource/how-to-choose-an-ai-platform-for-your-association.html) ## Security questions, answered The questions boards, IT teams and procurement ask us most often. What security certifications does ReadyIntelligence have? ReadyIntelligence is SOC 2 Type II and ISO 27001 certified, both independently audited. Supporting documentation is available on request for your IT, data protection or procurement team. Where is our data hosted? You choose US or EU hosting. With EU hosting, your data and the services that process it stay within the European Union, which matters if you have GDPR or data residency requirements. How is our data kept separate from other organisations? Each client runs in its own isolated environment with a dedicated database and storage, so data can't cross from one organisation to another. Every query is scoped to your organisation, and that separation is enforced at infrastructure level, not just in configuration. Is our content sent to third-party services to be indexed? No. ReadyIntelligence runs its own search infrastructure, so your documents are indexed and stored on infrastructure we control rather than being sent to a third-party embedding service. How does the permissions model work? ReadyIntelligence operates on a default-deny model — the assistant only sees data sources that have been explicitly configured and permissioned. On top of that, it checks each user's access rights at the point of query, so members and staff only ever receive information they are already authorised to see. You can widen access gradually as your confidence in the platform grows. Which single sign-on options does ReadyIntelligence support? Two. With OpenID Connect, people sign in through your own identity provider, such as Microsoft Entra ID or Okta, after you register ReadyIntelligence as an application with it. Or your website can pass the assistant a signed token (JWT) for the person already signed in, which ReadyIntelligence verifies before trusting it. Either way, details your identity provider holds, such as groups or membership type, can decide what each person is allowed to see. Does ReadyIntelligence train AI models on my data? No. Your content and data are used to answer your users' questions, not to train foundation models. Information stays within your permissioned knowledge base, with EU data residency available, and is never fed back into general-purpose model training. Is ReadyIntelligence GDPR-compliant? ReadyIntelligence is designed to support your GDPR obligations, with permission-aware access controls, source traceability and EU data residency built in, and it is SOC 2 Type II and ISO 27001 certified. Compliance also depends on how your organisation configures and uses the platform, so talk to our team if you need supporting documentation. [See all FAQs](https://readyintelligence.com/resources/faqs.html)