# Auctoric Trust Center & Governance Framework > Auctoric provides enterprise-grade Governed AI infrastructure with cryptographic continuous compliance, zero model training on customer data, and deterministic runtime guardrails. ## Canonical Policy Instruments - [Accessibility Conformance Statement (VPAT® / WCAG 2.2 AA / Section 508)](https://trust.auctoric.ai/compliance/accessibility/vpat-wcag22aa-section508): Scope of Assessment: Evaluates the Auctoric Governed AI web console, workflow builder, and documentation portals against WCAG 2.2 Level A/AA... - [AI Data Processing & Model Non-Retention Addendum](https://trust.auctoric.ai/compliance/ai-governance/ai-dpa-model-non-retention-addendum): Absolute Zero-Training Guarantee: Under no circumstances will Auctoric, or our upstream model providers, train, retrain, or RLHF base models... - [Automated Decision-Making (ADM) Notice](https://trust.auctoric.ai/compliance/ai-governance/automated-decision-making-notice): Scope of Internal ADM: Auctoric uses automated decision-making solely for internal infrastructure defense (e.g., threat detection, rate limi... - [ISO 42001 & EU AI Act Governance Policy](https://trust.auctoric.ai/compliance/ai-governance/iso-42001-eu-ai-act-policy): Core Purpose: Establishes Auctoric's corporate Artificial Intelligence Management System (AIMS) conforming to ISO/IEC 42001:2023 and the EU ... - [Responsible AI & Ethics Statement](https://trust.auctoric.ai/compliance/ai-governance/responsible-ai-ethics-statement): Core Mission: Auctoric builds governed AI systems designed to augment human potential while actively protecting human agency, dignity, and f... - [Code of Ethics & Business Conduct](https://trust.auctoric.ai/compliance/governance/code-of-ethics): Purpose & Scope: Establishes mandatory ethical standards, statutory compliance rules, and professional conduct expectations for all Auctoric... - [Whistleblower & Non-Retaliation Policy](https://trust.auctoric.ai/compliance/governance/whistleblower-policy): Scope & Protected Matters: Covers reporting of financial fraud, AI safety circumventions, benchmark manipulation, antitrust violations, data... - [Acceptable Use Policy (AUP)](https://trust.auctoric.ai/compliance/legal/acceptable-use-policy): Core Scope: This Acceptable Use Policy defines strictly prohibited use cases across the Auctoric Governed AI Platform, developer APIs, and a... - [AI Service-Specific Terms (SST) — Schedule 1](https://trust.auctoric.ai/compliance/legal/ai-service-specific-terms): Purpose of Schedule 1: Operates as a modular schedule to the MSA and ToS, governing AI-specific capabilities including multi-model routing, ... - [Customer Copyright & IP Protection Addendum](https://trust.auctoric.ai/compliance/legal/customer-copyright-ip-protection-addendum): Commitment Overview: Auctoric provides a binding Customer Copyright Commitment (CCC) that defends and indemnifies enterprise customers again... - [Data Processing Addendum (DPA) with Standard Contractual Clauses (SCCs)](https://trust.auctoric.ai/compliance/legal/data-processing-addendum): Purpose & Roles: This DPA regulates the processing of personal data under GDPR, UK GDPR, and CCPA/CPRA. Customer acts as Controller (or Proc... - [Global Privacy Policy](https://trust.auctoric.ai/compliance/legal/global-privacy-policy): Scope & Demarcation: This Policy governs personal data Auctoric collects as an independent Data Controller (website visitors, platform accou... - [Master Services Agreement (MSA)](https://trust.auctoric.ai/compliance/legal/master-services-agreement): What this agreement covers: This Master Services Agreement (MSA) governs commercial procurement, enterprise access, and legal rights for the... - [Authoritative Sub-processor & Infrastructure Provider Schedule](https://trust.auctoric.ai/compliance/legal/sub-processor-schedule): Core Scope: Enumerates all external cloud hyperscalers, foundation model inference APIs, and operational monitoring vendors authorized to pr... - [Terms of Service (ToS)](https://trust.auctoric.ai/compliance/legal/terms-of-service): Scope: These Terms govern self-service developer access, SDKs, APIs, and web console use. If your company executes a custom Master Services ... - [CJIS Security Addendum & Contractor Compliance Agreement](https://trust.auctoric.ai/compliance/sector-compliance/cjis-security-addendum-mca): Purpose & Authority: Incorporates the uniform FBI CJIS Security Addendum (Form CJIS-001c) governing private contractor access to Criminal Ju... - [HIPAA Business Associate Agreement (BAA)](https://trust.auctoric.ai/compliance/sector-compliance/hipaa-baa): Core Agreement: Serves as a formal Business Associate Agreement allowing covered entities and business associates to transmit and process el... - [Information Security Policy (ISP)](https://trust.auctoric.ai/compliance/security-trust/information-security-policy): Security Mandate: Establishes Auctoric's Information Security Management System (ISMS) designed to comply with ISO/IEC 27001:2022, SOC 2 Typ... - [PCI-DSS Responsibility Matrix & Compliance Summary](https://trust.auctoric.ai/compliance/security-trust/pci-dss-matrix-aoc): Subscription Billing Scoping: Operates under PCI-DSS SAQ-A. Customer payment data is entered directly into hosted client-side iFrames manage... - [Shared Responsibility Matrix](https://trust.auctoric.ai/compliance/security-trust/shared-responsibility-matrix): Tripartite Model: Security and compliance are co-managed across three tiers: (1) Upstream Cloud & Model Providers (physical facilities, virt... - [System Security Plan (SSP) Summary](https://trust.auctoric.ai/compliance/security-trust/system-security-plan-summary): Authorization Boundary: Encompasses all production container clusters, LLM inference serving pods, RAG vector stores, and cryptographic key ... - [SBOM and MBOM Architecture Guidelines](https://trust.auctoric.ai/compliance/technical-standards/sbom-mbom-guidelines): Dual-BOM Architecture: Auctoric establishes end-to-end supply chain transparency across traditional code (SBOM) and generative machine learn... - [Secure Software Development Lifecycle (SSDLC) Policy](https://trust.auctoric.ai/compliance/technical-standards/ssdlc-policy): Engineering Philosophy: Embraces Shift-Left security and continuous AI verification to embed safety controls into every commit, container bu... - [Vulnerability Disclosure Policy (VDP) & Coordinated Disclosure](https://trust.auctoric.ai/compliance/technical-standards/vulnerability-disclosure-policy): Safe Harbor Authorization: Auctoric considers good-faith security research complying with this policy to be authorized under CFAA (18 U.S.C.... ## Security & Verification Endpoints - [Real-time Attestation Ledger](https://trust.auctoric.ai/telemetry-pulse.json): NIST SP 800-137 ConMon real-time JSON attestation pulse. - [Sigstore Rekor Commit Proof](https://trust.auctoric.ai/commit-proof.json): Cryptographic commit provenance and Rekor transparency log proof. - [Deterministic Control Index](https://trust.auctoric.ai/control-index.json): Complete matrix of 29 security controls mapped to ISO 27001, SOC 2, and NIST SP 800-53. - [Vendor Risk Compliance Feed](https://trust.auctoric.ai/compliance/feed.xml): Automated RSS 2.0 / Atom feed for enterprise GRC ingestion. - [PGP Security Encryption Key](https://trust.auctoric.ai/pgp-key.txt): RFC 9116 armored PGP key for vulnerability disclosure.