Trust Center

Trust youcan verify.

Users check the answers; auditors check the system. This page sets out where data goes in AMAS, the controls built into the product, Frontier Technology’s company credentials, and who to contact about a security concern.

ISO/IEC 27001:2022Company ISMS certification
Hybrid / On-premFiles and indexes stay on your network
Audit trailWrite-protected at the database layer
Security contactsupport@frontierteches.com

01 — Data boundary

Exactly what crosses the line.

Source files and indexes stay on your network. In hybrid mode, only the question and the passages the asker is allowed to see are sent for inference.

On-premisesYour network

Source filesStored on your network; downloads always permission-checked
Parsing & indexText, tables, OCR, semantic + keyword index
Permission filterRetrieval only within what the asker may see
Audit trailWrite-protected at the database layer

Data boundary

Question + permission-filtered passages

Generated answer

Files & index never leave

Cloud or on-prem GPUAI inference

HybridCloud LLM from the one provider you choose
Fully on-premYour own GPU server — nothing sent out for inference
Switch in 30 sNo restart. No silent fallback to the cloud.

Chart and diagram pages use cloud vision by default and can be switched to on-prem. External lookups are limited to allow-listed sites.

Files and indexes stay on-prem
Retrieval and permission filtering run on your network. In cloud mode, only the question and permission-filtered passages are sent out.
Chart vision: cloud by default
Chart and diagram pages use cloud vision by default and can be switched to an on-prem model.
Fully on-prem when you need it
Admins switch between cloud and on-prem in settings — effective within 30 seconds, no restart.
No silent cloud fallback
If on-prem inference is down, AMAS shows an error instead of quietly routing to the cloud.
You choose the provider
In cloud mode AMAS uses only the provider you select, and never switches vendors on its own.
Cloud spend you can see
Usage and estimated cost by department and user, exportable to CSV.

Outbound connectivity: external knowledge updates and online upgrades need outbound HTTPS 443 only — nothing inbound.

02 — Built into AMAS

Users check the answers. Auditors check the system.

These are mechanisms in the product itself. Which modules are enabled depends on your deployment and agreement.

Access control

Permissions follow the person. AI never widens them.

Filtered before every answer: Citations, AI advisors and deep research never bypass the asker’s access.
Four levels × roles × departments: Public, internal, confidential and restricted — then narrowed by role and department.
Existence hiding: Users without access get the same response whether or not a document exists.
Separation of duties: IT admins see only structural metadata of content not shared with them; access decisions belong to the owning department.
Layered protection for sensitive fields: Salary data, for example, is shown as actual values, a relative index, or denied — by role.

Citations & traceability

Every answer can show its sources.

[n] citations to the source: Every answer carries citations you can open, and labels which kind of source it used.
Says so when evidence is thin: When evidence is insufficient, AMAS declines or marks the answer as ungrounded.
Answer-quality monitoring: Continuously measures the share of answers given without supporting sources.

Audit

Who did what, and when, is on record.

Five record types: Q&A, enterprise-system actions, security events, role changes and super-admin actions.
Write-protected at the database layer: Retention templates available: 5 years for general business, 7 years for finance and healthcare.
No self-oversight: Admins cannot view their own audit records.

Administration & identity

Even the highest privilege has limits.

Three-tier administration: Super-admin is CLI-only with two-person presence; break-glass access is time-limited and logged.
Secure SSO defaults: LDAPS enforced, at least one local admin always retained, admin roles never granted via AD groups.
Remote support on your terms: Authorised by you, time-limited, revocable, with no view of documents or conversations.

External input & connections

Sanitise what comes in. Control what goes out.

Prompt-injection sanitising: Inbound customer messages and other external content are sanitised before they reach the AI.
Allow-listed external lookups: External lookups are limited to allow-listed sites.
Server-side checks on every download: Files are returned only after a server-side permission check — no public or shareable links.

Deployment & supply chain

Sensitivity decides the deployment.

Hybrid or fully on-prem: Start hybrid with no up-front GPU purchase; run inference on your own GPU server when data must stay inside your network.
SBOM with CVE matching: A CycloneDX software bill of materials, matched against known vulnerabilities.
Runs on a single server: Pilot with one department, then scale company-wide; enable modules as you need them.

03 — Frontier Technology

The company behind the product is audited too.

Frontier Technology is certified to ISO/IEC 27001:2022. The certification covers how we run the company and build software — it is not a certification of AMAS itself.

Built in-houseOn-prem inference, retrieval, the permission model and audit trail are all built by our own team.
Third-party testingGovernment projects have passed third-party vulnerability scanning and source code review, with fixes regression-tested.
Public sectorA public-sector LLM + RAG knowledge platform now in its third consecutive term, meeting top-tier government cybersecurity requirements.

All company credentials

Company certification

ISO/IEC 27001:2022

Certificate: ARES/TW/I2507041I
Valid: 3 July 2025 – 2 July 2028
Accreditation: IAS-accredited (ACC No. MSCB-171), IAF MLA recognised
Scope: Information security across the software development lifecycle, and protection of client data and intellectual property.

This certifies Frontier Technology’s information security management system — it is not a product certification.

04 — Responsible AI

AI drafts. People decide.

Across every AMAS product, AI prepares and points out — the decisions that matter stay with a person who can be held accountable.

01
AI assists. It does not decide.
Video triage only flags “possible” events for a person to confirm against the footage; AI customer service only drafts, and agents send.
02
People confirm the critical steps
Confirmation before writing to enterprise systems and before external lookups; documents go live only after review.
03
Knowledge enters by approval
Good answers enter the knowledge base only after sign-off; when knowledge is revised, the current version stays in use until the update is approved.
04
Accuracy measured on your data
Accuracy is measured on your own material — we do not borrow numbers from other projects as promises.

05 — Report a security issue

Found something? Tell us directly.

If you believe you have found a vulnerability in AMAS or on our websites, email our security contact. Please include what is affected, steps to reproduce and how to reach you, and avoid sharing details publicly until we have been in touch.

support@frontierteches.com

Machine-readable contact details follow RFC 9116 at /.well-known/security.txt.

06 — Security reviews

Running a vendor security review?

Government and enterprise buyers often need a security questionnaire or supplier assessment before adopting AI. Supporting material can be provided during a demo or on request.

Deployment and data-flow walkthrough
Access-control and audit design, shown on the product
Responses to your own questionnaire

Next step

See it on your documents.

Book a working session on-site, online or at your office. We will show answers, citations and permissions on material you choose.

Book a demo support@frontierteches.com

Trust youcan verify.

Exactly what crosses the line.

Files and indexes stay on-prem

Chart vision: cloud by default

Fully on-prem when you need it

No silent cloud fallback

You choose the provider

Cloud spend you can see