Built audit-ready by default.
Every Praxara customer gets the evidence pack their auditor needs. Hosting in the EU, encryption end-to-end, MFA on by default for admins, SHA-256 chained audit log that any inspector can verify.
One-pagers
Print-friendly summaries you can save as PDF and forward to security, procurement or your auditor. No Praxara account needed; the same content lives on this site.
Positioning, frameworks, hosting, sub-processors, pricing, procurement contacts.
Open and print →Hosting, encryption, identity, audit chain, application security, DR, certifications.
Open and print →EU AI Act Articles 9 / 11 / 13 / 14 mapping, Annex 22 alignment, change-control.
Open and print →Representative 8-artefact bundle with no customer data. Same structure your real pack will have on day-one of your pilot.
Azure West Europe by default. Regional residency on request.
TLS 1.3 in transit, AES-256 at rest, keys in Azure Key Vault.
MFA on by default for admins. SAML SSO on Enterprise.
SHA-256 chained, ALCOA+ aligned, verifiable on demand.
Every action — login, document upload, AI call, e-signature, export — is written to an append-only audit log. Each row contains a SHA-256 hash of itself plus the previous row, so tampering anywhere in the chain breaks every later row's hash.
The audit log is ALCOA+ aligned: Attributable, Legible, Contemporaneous, Original, Accurate — plus Complete, Consistent, Enduring, Available. This is the form an FDA or MHRA inspector expects.
Tenant administrators can verify the chain on demand from app.praxara.io/audit and export a CSV for inspector review.
What we have, what's in flight, what's next.
AICPA Trust Services Criteria — Security, Availability, Confidentiality. External auditor engaged.
Observation period started Q1 2026. Type II report issued under NDA.
Information Security Management System covering policy, people, technology and operations. SoA + Annex A controls maintained in docs/compliance/.
Gap analysis complete. Stage 1 audit booked H2 2026.
IASME / NCSC scheme covering boundary firewalls, secure configuration, access control, malware protection and patch management.
Self-assessment complete; technical audit in scheduling.
Black-box + authenticated testing of web app, API, and tenant isolation by an independent CREST-accredited tester.
Attestation letter and remediation summary on request under NDA.
Customers under NDA may request observation-period letters, gap-analysis reports, and pen-test attestations from [email protected].
Live operational evidence.
Decision support, never auto-submit.
Human in the loop, always. Every AI output is reviewed and e-signed by a qualified human before export. Praxara does not auto-submit to any regulator.
No training on your data. Enterprise terms with Anthropic, Google, OpenAI and Azure exclude training use of customer inputs. Inputs are not retained beyond the call by any of the listed sub-processors.
Model card per skill. Every skill has a model card with intended use, training data scope, evaluation, known limitations, residual risks. Cards live in /admin/ai-governance.
EU AI Act ready. Article 9 risk register, Article 11 technical documentation, Article 13 transparency obligations and Article 14 human oversight controls all maintained in-platform.
Auditable to the model call. Any claim in any output can be traced back to the exact model call that produced it and the reviewer who approved it.
Drift detection. Skill outputs benchmarked weekly against a fixed evaluation set; regressions raise alerts in /admin/drift.
See it against your own documents.
20-minute demo. Bring a redacted CSR, PSMF, or ICSR. We'll run it live end-to-end.