Enterprise AI security you can verify.

Security and compliance status

The live Trust Center lists three frameworks as compliant and four programmes as in progress. The statuses below were checked on 2 October 2026.

• 

  ISO 27001

  Compliant

  The Bibha AI Trust Center lists ISO 27001 as compliant. ISO 27001 is the international standard for an information security management system. Request the assurance documents and confirm their scope for your engagement.

• 

  SOC 2

  Compliant

  The Bibha AI Trust Center lists SOC 2 as compliant. Contact us for assurance documents, including the report type, scope and review period relevant to your assessment.

  The Trust Center is the current public status record.

• 

  SOC 1

  Compliant

  Bibha is SOC 1 compliant. SOC 1 is an AICPA examination of controls at a service organisation that are likely to be relevant to its customers' internal control over financial reporting. The current status is published at the Trust Center.

• 

  GDPR

  In progress

  Our EU GDPR programme addresses personal data processing and platform data controls, including processing boundaries, agreed retention and deletion, and encryption and key responsibilities. Its public status is in progress.

• 

  UK GDPR

  In progress

  UK GDPR runs as a parallel programme alongside the EU GDPR work. The Bibha AI Trust Center lists its status as in progress.

• 

  ISO/IEC 42001:2023

  In progress

  ISO/IEC 42001 covers AI governance, risk management and the responsible operation of AI systems. The Bibha AI Trust Center lists our programme as in progress.

• 

  EU AI Act

  In progress

  The EU's risk-based AI regulation maps onto how Bibha operates AI systems: documented AI governance, defined change and release authority, and the ability to stop work and revoke access. Final conformity work is in progress.

Review the latest status at the Bibha AI Trust Center and request assurance documents with their scope and dates before making a procurement decision.

AI governance and data privacy, built into the platform

Bibha brings access, data and operating controls into the platform, with evidence and responsibilities tied to the configuration you agree.

• AI governance

  • Our ISO/IEC 42001 programme covers governance, risk management and responsible AI practices. Its current status is in progress.
  • EU AI Act readiness runs as a parallel programme, with its status published at the Trust Center.
  • Change and release authority defines who approves material changes and production releases.
  • Proposed changes are evaluated and released through a controlled process, rather than assumed to improve the system automatically.
  • Emergency stop and revocation let authorised people stop unsafe work and withdraw access.

• Data privacy

  • GDPR and UK GDPR programmes are listed as in progress at the Trust Center.
  • Processing boundaries record where information is stored and processed across the configured system.
  • Retention and deletion controls apply the agreed retention periods and removal processes.
  • Use Bibha as a cloud service, or discuss hybrid and on-premises deployment. See data residency for where each part of the system runs.

Security controls across the platform

Each control below is a platform capability, applied to the configuration agreed for your system. The Bibha AI Trust Center monitors the wider programme across product, data, network, application, endpoint and corporate security, and publishes live status.

• Access and identity

  • Identity and access controls govern entry to and administration of the platform.
  • Roles and permissions separate viewing, editing, execution and release authority.
  • Organisation and data boundaries maintain the customer and project boundaries defined for the system.
  • Audit history records important access, configuration and operational changes.

• Data protection

  • Encryption and key ownership are documented, so your team and the operator know which controls each side owns.
  • Backup and restore protect the assets in scope, including testing how they are restored.
  • Export and transition assistance provide the agreed usable assets and handover support.
  • In PeachDesk, provider credentials are encrypted at rest with Fernet, AES-128 with HMAC authentication, and API keys are stored only as SHA-256 hashes.

• Application security

  • Policy enforcement applies rules to data use, models, tools and operations.
  • Tool connections run within the action boundaries the task needs.
  • A supplier and dependency register identifies external services, licences and runtime dependencies.
  • In PeachDesk, tenant isolation is guarded by a CI test and webhooks are signed on every call event.

• Deployment control

  • Use Bibha as a cloud service, or discuss hybrid and on-premises deployment when parts of the system need to run in your own environment.
  • Rollout and rollback introduce approved configurations with a path back to a previous one.
  • Health monitoring detects unhealthy components and supports the agreed recovery work.
  • Infrastructure monitoring shows the health and utilisation of compute and serving resources.

Controls evolve with the platform. The continuously monitored view of the wider programme is in the controls register at the Bibha AI Trust Center.

Responsible disclosure and security contacts

Security reviews move faster when both sides work from evidence. These are the ways to reach us directly.

• Report a vulnerability

  Email dpo@bibha.ai with a description of the issue, the affected address or service and the steps to reproduce it. Please do not access, change or delete data that is not yours, and allow us time to fix the issue before you disclose it publicly.

• Privacy and data protection

  Our Data Protection Officer, Prashant Kumar, handles GDPR and privacy-rights enquiries at dpo@bibha.ai. Send privacy requests to privacy@bibha.ai. Our privacy policy explains what we collect and why.

• Security reviews

  Send your security questionnaire or requirements through our contact page. We answer from the evidence and the live record at the Trust Center.

Our security contact is also published in machine-readable form at /.well-known/security.txt, following RFC 9116, with English and German as the preferred languages.