Tenancy and isolation
Every customer runs on capacity that is not shared with another customer. Network paths, storage buckets and key material are separated per deployment, with no cross-tenant service account.
Security and data handling
Written down, testable, and open to your review.
This page summarises how a B2BLLM Secure deployment is isolated and audited. It is not a substitute for a review - we answer questionnaires and join architecture calls, and we would rather be challenged than trusted.
Identity and access
Administrative access goes through your identity provider wherever possible. Our own access is named, time-bound and approved per session, and every elevated action lands in the audit trail.
Data handling
Prompts, responses, embeddings and documents stay in the environment we deploy. Retention is a configuration decision agreed in writing, not a default buried in a vendor policy.
Logging and audit
Request metadata, administrative actions and configuration changes are logged with actor, timestamp and outcome. Logs export to your SIEM, and log access is itself logged.
Supply chain
Container images are pinned by digest and pulled from a controlled registry. Dependencies are scanned on ingest and on a schedule, and model artefacts are verified against published checksums.
Resilience
Backups cover configuration and metadata, with a documented restore process that is tested rather than assumed. Model weights are treated as replaceable and rebuilt from pinned artefacts.
Change management
Production changes go through peer review and a change window. Emergency changes are permitted, but they are documented afterwards and reviewed at the next service meeting.
Incident response
One severity scale, one on-call rotation, one communication channel. We notify affected customers without waiting for a complete root-cause picture, and we publish a written post-incident review.
Subprocessors
Subprocessors are listed in the contract and require your written approval to change. Where a deployment runs in your own account, most of that list disappears entirely.
Standards and attestations
We work to controls aligned with ISO/IEC 27001 and, for deployments that process personal data, to the obligations of the GDPR. We are deliberately precise about the difference between "aligned" and "certified".
- ISO/IEC 27001-aligned control set, mapped in a document we can share under NDA
- GDPR data processing agreement, with EU/EEA hosting by default
- Named security contact and a documented vulnerability disclosure process
- Penetration testing scoped with your team before go-live, results shared in full
Reporting a vulnerability
If you believe you have found a security issue in anything we operate, write to sale@b2bllmsecure.site with the subject line "Security report". Include enough detail to reproduce the issue.
- We acknowledge reports within two business days
- We do not pursue legal action against good-faith research on our own infrastructure
- Please do not test against customer environments without prior written agreement
Need the long version for your review?
Send your vendor questionnaire and we will return it completed, together with the reference architecture and data-flow diagram for the deployment you are considering.