--- source: https://asaptic.com/security/ title: AI Governance, Security & Trust Center | Asaptic description: Asaptic AI Governance, Security & Trust Center: zero-PII leak gate, cryptographic tenant data isolation, EU AI Act Art. 50 transparency, GDPR & Hong Kong PDPO compliance, SHA-256 audit trails, and security@asaptic.com disclosure. --- # AI Governance, Security & Trust Center | Asaptic AI GOVERNANCE · ZERO-PII GATE · CRYPTOGRAPHIC PROVENANCE · RFC 9116 # AI Governance, Security & Trust Center Asaptic operates an autonomous cross-border trade and compliance execution engine across seven public-procurement jurisdictions. Every tender parse, clause-equivalence verification, supplier qualification, and commercial quote is governed by a deterministic zero-PII leak gate, tenant workspace isolation, cryptographic SHA-256 audit trails, and mandatory human sign-off on binding commitments. [Report a Vulnerability (security@asaptic.com)](mailto:security@asaptic.com) [Inspect Cryptographic Proof Manifest](/.well-known/asaptic-proof.json) TRUST ARCHITECTURE · LIVE CONTROLS Zero-PII deterministic pre-dispatch & context redaction gate Every inbound RFQ, supplier dossier, and outbound bid package passes automated structural redaction before entering model context or external feeds. AI TRANSPARENCYEU AI Act Art. 50 DATA PRIVACYGDPR & HK PDPO DISCLOSUREsecurity@asaptic.com [verify /.well-known/asaptic-proof.json →](/.well-known/asaptic-proof.json) **0** cross-tenant context sharing or training**100%** human sign-off on binding commercial commitments**SHA-256** tamper-evident execution receiptsDisclosure channel: [security@asaptic.com](mailto:security@asaptic.com) CORE SECURITY & GOVERNANCE PILLARS ## Six architectural controls governing every AI trade execution workflow. Security and regulatory accountability at Asaptic are enforced at the protocol and pipeline layer — not left to ad-hoc prompt instructions. 01 // ZERO-PII LEAK GATE ### Deterministic Zero-PII Redaction & Outbound Firewall Asaptic enforces a multi-stage deterministic scrubbing gate across all ingestion and publication pipelines. Personal names, national identity numbers, corporate registration numbers, room/flat street coordinates, bank account details, and counterparty-confidential pricing are stripped prior to AI context assembly and blocked from public feeds (/tender/rows.json, /mcp, and static HTML surfaces). - Pre-ingestion regex + AST structural sanitizers strip personal identifiers and street-level coordinates before tokenization - Outbound publication firewall blocks any artifact containing unredacted counterparty PII or confidential commercial terms - Automated CI verification scans 100% of rendered routes for zero PII and zero sensitive entity leakage prior to deployment 02 // TENANT DATA ISOLATION ### Cryptographic & Logical Tenant Workspace Isolation Buyer RFQs, government tender bid strategies, and factory qualification dossiers execute inside logically isolated tenant namespaces. Asaptic never pools proprietary buyer specifications or supplier cost structures across competing engagements, and never trains foundation models on tenant commercial data. - Strict per-engagement namespace partitioning across vector indices, document object stores, and execution state - Zero cross-tenant context window reuse; ephemeral execution sandboxes purged upon task completion - Contractual and technical prohibition on using customer RFQ or supplier pricing data for external model training 03 // EU AI ACT ART. 50 TRANSPARENCY ### EU AI Act Article 50 Transparency & Human-in-the-Loop Governance In full alignment with EU AI Act Article 50 transparency obligations and international AI governance standards, Asaptic clearly identifies AI-generated compliance mappings, tender summaries, and draft technical proposals. While our pipeline operates approximately 99% autonomously for research and document assembly, every legally or financially binding commitment requires explicit human operator authorization. - Machine-readable provenance headers and explicit human-readable disclosures on all AI-assisted compliance artifacts - Mandatory human-in-the-loop review and sign-off before dispatching Proforma Invoices, purchase orders, or signed contracts - Deterministic citation linking every AI compliance claim to specific GB, IEC, ISO, EN, UL, or FDA standard clauses 04 // GDPR & HK PDPO COMPLIANCE ### GDPR & Hong Kong PDPO (Cap. 486) Regulatory Alignment Asaptic operates exclusively in B2B institutional supply chains from Hong Kong SAR, adhering to the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486, PDPO) and the EU General Data Protection Regulation (GDPR) for European counterparties. We apply strict data minimization, collecting only business-contact metadata necessary to execute commercial procurement. - Lawful processing grounded in B2B contractual necessity and legitimate institutional procurement interest - Data minimization and purpose limitation: zero consumer profiling, zero behavioral advertising trackers, zero third-party data brokering - Prompt fulfillment of data access, rectification, and erasure requests via security@asaptic.com and engage@asaptic.com 05 // CRYPTOGRAPHIC AUDIT TRAILS ### SHA-256 Execution Receipts & Falsifiable Proof Surfaces Every automated tender ingestion cycle, cross-standard equivalence matrix, and platform build emits a cryptographic SHA-256 digest into our append-only audit log. Institutional buyers, auditors, and autonomous agents can independently verify platform state against our public proof manifest. - Publicly verifiable proof manifest published at /.well-known/asaptic-proof.json with live telemetry at /status/ - Immutable SHA-256 content hashes linking each compliance determination to its underlying regulatory source clause - Tamper-evident execution logs retained for institutional audit and government tender post-award verification 06 // RESPONSIBLE DISCLOSURE (RFC 9116) ### Vulnerability Reporting & Safe-Harbour Commitment Asaptic welcomes good-faith security research across our web properties, public JSON feeds, and Model Context Protocol (/mcp) endpoints. We provide a dedicated disclosure channel at security@asaptic.com and extend a formal safe-harbour commitment to researchers who follow this policy. - Primary security disclosure inbox: security@asaptic.com (PGP & RFC 9116 metadata at /.well-known/security.txt) - Acknowledgement within 24 hours; triage and remediation timeline within 72 hours for verified findings - Full legal safe harbour for good-faith researchers who avoid privacy violations, data destruction, and service disruption RFC 9116 DISCLOSURE POLICY & SCOPE ## Reporting Channel, Covered Surfaces & Safe-Harbour Rules To report a suspected vulnerability, privacy concern, or AI governance issue, email security@asaptic.com with [SECURITY] in the subject line. Security Disclosure Email[security@asaptic.com](mailto:security@asaptic.com)General & Compliance Inquiries[engage@asaptic.com](mailto:engage@asaptic.com)RFC 9116 Policy File[/.well-known/security.txt](/.well-known/security.txt)Cryptographic Proof Manifest[/.well-known/asaptic-proof.json](/.well-known/asaptic-proof.json)Supported LanguagesEnglish · 简体中文 · 繁體中文 · PortuguêsAcknowledgement Target ### In-Scope Surfaces **asaptic.com** — all public HTML & localized routes**/tender/rows.json** — live public tender ledger**/mcp** — Model Context Protocol server endpoints**/api/v1/*** — public verification & health APIs**/.well-known/*** — proof & security manifests ### Out-of-Scope Activities **—** Volumetric DoS / DDoS or rate-limit exhaustion**—** Social engineering or phishing of personnel or partners**—** Physical security testing against facilities**—** Automated scanner output without demonstrable exploitability FAQ ## AI Governance & Security FAQ ### How does Asaptic prevent PII or confidential tender data from leaking into public feeds or LLMs? Asaptic runs a deterministic Zero-PII Leak Gate before any document enters model context or public indexes. Automated AST and pattern sanitizers strip personal names, registration numbers, street/room addresses, and confidential pricing, and each build is verified prior to deployment. ### How does Asaptic comply with EU AI Act Article 50 and human oversight requirements? All AI-generated compliance matrices, standard mappings, and tender analyses carry explicit machine-readable and human-readable provenance disclosures. Furthermore, every binding commercial action — including Proforma Invoice issuance, purchase order confirmation, and contract signature — requires human operator review and sign-off. ### How do I report a security vulnerability or data privacy issue to Asaptic? Send a detailed report to security@asaptic.com with the subject prefix [SECURITY], including the affected URL or endpoint and minimal non-destructive reproduction steps. Good-faith researchers acting within our RFC 9116 policy receive full safe-harbour protection.