Security at eeko.

1. Our Approach

eeko Systems LLC builds enterprise AI systems for organizations that operate under real regulatory and contractual obligations. We treat security and compliance as default conditions of every engagement rather than optional extras. That means we make conservative, defensible choices about how data is stored, who can access it, and how every action is recorded — and we do so before a single line of production code is written.

• Security requirements are identified during scoping and built into the architecture, not retrofitted.
• We apply the principle of least privilege, defense in depth, and data minimization across every system.
• We design for auditability so that decisions and data access can be reconstructed and reviewed.

2. Data Encryption

Client data is protected in transit and at rest using strong, industry-standard cryptography.

• Data in transit is encrypted using TLS 1.2 or higher.
• Data at rest is encrypted using AES-256 or equivalent.
• Encryption keys are managed through dedicated key-management services with controlled access and, where required, customer-managed keys.
• Secrets and credentials are never stored in source code or logs.

3. Deployment Options

Different organizations have different data-residency and isolation requirements. We support a range of deployment models so that you can choose the boundary that matches your risk profile.

• Cloud: deployed in a managed, hardened cloud environment with isolation and encryption applied throughout.
• Customer VPC: deployed inside your own virtual private cloud, under your network and identity controls.
• Fully on-premises: deployed entirely within your own infrastructure so that data never leaves your environment.

For sensitive workloads, on-premises and VPC deployments allow you to keep all data, models, and processing within a boundary you control end to end.

4. Access Control

Access to systems and data is granted on a strict need-to-know basis and is continuously constrained.

• We enforce least-privilege access: identities receive only the permissions required for their role.
• Authentication is secured through single sign-on (SSO) and, where supported, multi-factor authentication.
• Authorization is governed by role-based access control (RBAC).
• eeko Systems maintains no standing access to client data; access is granted only when required to deliver the engagement and is revoked when no longer needed.

5. Audit Logging & Observability

You should be able to see what happened, when, and why. Our systems are instrumented to make actions and AI decisions reviewable.

• Security-relevant events are captured in append-only audit logs that resist tampering.
• AI decisions are designed to be traceable, with the inputs, sources, and reasoning steps recorded where applicable.
• Observability tooling surfaces anomalies and supports investigation and compliance reporting.
• Logs are scoped to avoid capturing unnecessary sensitive data.

6. Compliance Alignment

We build to recognized control frameworks and design deployments to support the regulatory obligations our clients operate under.

• Our controls are SOC 2-aligned, covering security, availability, and confidentiality principles.
• We deliver HIPAA-aware deployments for healthcare workloads involving protected health information.
• We support SOX-aware controls for financial-reporting environments.
• We design GDPR-aware systems that respect data-subject rights and data-minimization principles.

7. Secure Development

Security is enforced throughout the software development lifecycle, not just at deployment.

• Changes are subject to code review before they reach production.
• Dependencies are monitored through automated dependency and vulnerability scanning.
• Secrets are handled through dedicated secrets management and never committed to source control.
• Environments are separated, and least-privilege principles apply to build and deployment pipelines.

8. Incident Response

We maintain a defined process for identifying, containing, and responding to security incidents.

• Incidents are triaged and contained according to a documented response procedure.
• Affected clients are notified in accordance with contractual and legal obligations.
• Post-incident reviews identify root causes and drive corrective and preventive actions.

9. Responsible Disclosure

We welcome reports from security researchers and the broader community. If you believe you have found a vulnerability in our systems, please report it to us privately so we can investigate and remediate it.

• Report suspected vulnerabilities to security@eeko.systems.
• Please provide enough detail to reproduce the issue, and give us a reasonable opportunity to remediate before any public disclosure.
• We ask that testing avoid privacy violations, data destruction, and service disruption.

10. Contact

For security questions, control documentation, or vulnerability reports, contact security@eeko.systems. For legal and contracting inquiries, contact legal@eeko.systems.