AI GOVERNANCE · ZERO-PII GATE · CRYPTOGRAPHIC PROVENANCE · RFC 9116

AI Governance, Security & Trust Center

Q: How does Asaptic prevent PII or confidential tender data from leaking into public feeds or LLMs?

Asaptic runs a deterministic Zero-PII Leak Gate before any document enters model context or public indexes. Automated AST and pattern sanitizers strip personal names, registration numbers, street/room addresses, and confidential pricing, and each build is verified prior to deployment.

Q: How does Asaptic comply with EU AI Act Article 50 and human oversight requirements?

All AI-generated compliance matrices, standard mappings, and tender analyses carry explicit machine-readable and human-readable provenance disclosures. Furthermore, every binding commercial action — including Proforma Invoice issuance, purchase order confirmation, and contract signature — requires human operator review and sign-off.

Q: How do I report a security vulnerability or data privacy issue to Asaptic?

Send a detailed report to security@asaptic.com with the subject prefix [SECURITY], including the affected URL or endpoint and minimal non-destructive reproduction steps. Good-faith researchers acting within our RFC 9116 policy receive full safe-harbour protection.

Asaptic operates an autonomous cross-border trade and compliance execution engine across seven public-procurement jurisdictions. Every tender parse, clause-equivalence verification, supplier qualification, and commercial quote is governed by a deterministic zero-PII leak gate, tenant workspace isolation, cryptographic SHA-256 audit trails, and mandatory human sign-off on binding commitments.

Report a Vulnerability ([email protected]) Inspect Cryptographic Proof Manifest

TRUST ARCHITECTURE · LIVE CONTROLS

Zero-PII

deterministic pre-dispatch & context redaction gate

Every inbound RFQ, supplier dossier, and outbound bid package passes automated structural redaction before entering model context or external feeds.

AI TRANSPARENCY

EU AI Act Art. 50

DATA PRIVACY

GDPR & HK PDPO

DISCLOSURE

[email protected]

verify /.well-known/asaptic-proof.json →

0 cross-tenant context sharing or training

100% human sign-off on binding commercial commitments

SHA-256 tamper-evident execution receipts

Disclosure channel: [email protected]

CORE SECURITY & GOVERNANCE PILLARS

Six architectural controls governing every AI trade execution workflow.

Security and regulatory accountability at Asaptic are enforced at the protocol and pipeline layer — not left to ad-hoc prompt instructions.

01 // ZERO-PII LEAK GATE

Deterministic Zero-PII Redaction & Outbound Firewall

Asaptic enforces a multi-stage deterministic scrubbing gate across all ingestion and publication pipelines. Personal names, national identity numbers, corporate registration numbers, room/flat street coordinates, bank account details, and counterparty-confidential pricing are stripped prior to AI context assembly and blocked from public feeds (/tender/rows.json, /mcp, and static HTML surfaces).

Pre-ingestion regex + AST structural sanitizers strip personal identifiers and street-level coordinates before tokenization
Outbound publication firewall blocks any artifact containing unredacted counterparty PII or confidential commercial terms
Automated CI verification scans 100% of rendered routes for zero PII and zero sensitive entity leakage prior to deployment

02 // TENANT DATA ISOLATION

Cryptographic & Logical Tenant Workspace Isolation

Buyer RFQs, government tender bid strategies, and factory qualification dossiers execute inside logically isolated tenant namespaces. Asaptic never pools proprietary buyer specifications or supplier cost structures across competing engagements, and never trains foundation models on tenant commercial data.

Strict per-engagement namespace partitioning across vector indices, document object stores, and execution state
Zero cross-tenant context window reuse; ephemeral execution sandboxes purged upon task completion
Contractual and technical prohibition on using customer RFQ or supplier pricing data for external model training

03 // EU AI ACT ART. 50 TRANSPARENCY

EU AI Act Article 50 Transparency & Human-in-the-Loop Governance

In full alignment with EU AI Act Article 50 transparency obligations and international AI governance standards, Asaptic clearly identifies AI-generated compliance mappings, tender summaries, and draft technical proposals. While our pipeline operates approximately 99% autonomously for research and document assembly, every legally or financially binding commitment requires explicit human operator authorization.

Machine-readable provenance headers and explicit human-readable disclosures on all AI-assisted compliance artifacts
Mandatory human-in-the-loop review and sign-off before dispatching Proforma Invoices, purchase orders, or signed contracts
Deterministic citation linking every AI compliance claim to specific GB, IEC, ISO, EN, UL, or FDA standard clauses

04 // GDPR & HK PDPO COMPLIANCE

GDPR & Hong Kong PDPO (Cap. 486) Regulatory Alignment

Asaptic operates exclusively in B2B institutional supply chains from Hong Kong SAR, adhering to the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486, PDPO) and the EU General Data Protection Regulation (GDPR) for European counterparties. We apply strict data minimization, collecting only business-contact metadata necessary to execute commercial procurement.

Lawful processing grounded in B2B contractual necessity and legitimate institutional procurement interest
Data minimization and purpose limitation: zero consumer profiling, zero behavioral advertising trackers, zero third-party data brokering
Prompt fulfillment of data access, rectification, and erasure requests via [email protected] and [email protected]

05 // CRYPTOGRAPHIC AUDIT TRAILS

SHA-256 Execution Receipts & Falsifiable Proof Surfaces

Every automated tender ingestion cycle, cross-standard equivalence matrix, and platform build emits a cryptographic SHA-256 digest into our append-only audit log. Institutional buyers, auditors, and autonomous agents can independently verify platform state against our public proof manifest.

Publicly verifiable proof manifest published at /.well-known/asaptic-proof.json with live telemetry at /status/
Immutable SHA-256 content hashes linking each compliance determination to its underlying regulatory source clause
Tamper-evident execution logs retained for institutional audit and government tender post-award verification

06 // RESPONSIBLE DISCLOSURE (RFC 9116)

Vulnerability Reporting & Safe-Harbour Commitment

Asaptic welcomes good-faith security research across our web properties, public JSON feeds, and Model Context Protocol (/mcp) endpoints. We provide a dedicated disclosure channel at [email protected] and extend a formal safe-harbour commitment to researchers who follow this policy.

Primary security disclosure inbox: [email protected] (PGP & RFC 9116 metadata at /.well-known/security.txt)
Acknowledgement within 24 hours; triage and remediation timeline within 72 hours for verified findings
Full legal safe harbour for good-faith researchers who avoid privacy violations, data destruction, and service disruption

RFC 9116 DISCLOSURE POLICY & SCOPE

Reporting Channel, Covered Surfaces & Safe-Harbour Rules

To report a suspected vulnerability, privacy concern, or AI governance issue, email [email protected] with [SECURITY] in the subject line.

Security Disclosure Email[email protected]

General & Compliance Inquiries[email protected]

RFC 9116 Policy File/.well-known/security.txt

Cryptographic Proof Manifest/.well-known/asaptic-proof.json

Supported LanguagesEnglish · 简体中文 · 繁體中文 · Português

Acknowledgement Target< 24 hours (business & critical 24/7)

In-Scope Surfaces

asaptic.com — all public HTML & localized routes/tender/rows.json — live public tender ledger/mcp — Model Context Protocol server endpoints/api/v1/* — public verification & health APIs/.well-known/* — proof & security manifests

Out-of-Scope Activities

— Volumetric DoS / DDoS or rate-limit exhaustion— Social engineering or phishing of personnel or partners— Physical security testing against facilities— Automated scanner output without demonstrable exploitability

FAQ

AI Governance & Security FAQ

How does Asaptic prevent PII or confidential tender data from leaking into public feeds or LLMs?

Asaptic runs a deterministic Zero-PII Leak Gate before any document enters model context or public indexes. Automated AST and pattern sanitizers strip personal names, registration numbers, street/room addresses, and confidential pricing, and each build is verified prior to deployment.

How does Asaptic comply with EU AI Act Article 50 and human oversight requirements?

All AI-generated compliance matrices, standard mappings, and tender analyses carry explicit machine-readable and human-readable provenance disclosures. Furthermore, every binding commercial action — including Proforma Invoice issuance, purchase order confirmation, and contract signature — requires human operator review and sign-off.

How do I report a security vulnerability or data privacy issue to Asaptic?

Send a detailed report to [email protected] with the subject prefix [SECURITY], including the affected URL or endpoint and minimal non-destructive reproduction steps. Good-faith researchers acting within our RFC 9116 policy receive full safe-harbour protection.