SOC 2 Type IIIn Progress Available on AWS Marketplace Microsoft Azure Marketplace Google Cloud Deploy on contract
Deployment & Procurement

Deploy EVE Anywhere

The first question every enterprise security review asks: "Can I run this in my environment?" Yes. EVE's governance control plane meets your data-residency and isolation requirements — and produces the same signed, independently verifiable evidence in every model.

Controls aligned to ECOA / Reg B SR 26-2 FCRA HIPAA EU AI Act NIST AI RMF SOC 2 Type II in progress

You control which decision fields are sent; in VPC and on-prem deployments, governed content and evidence stay inside your boundary. With EU AI Act GPAI-model obligations applicable since 2 August 2025 and high-risk-system obligations phasing in from 2 December 2027 (Annex III) and 2 August 2028 (Annex I) under Regulation (EU) 2026/1744, and with SR 26-2 (the April 2026 interagency model-risk guidance that superseded SR 11-7, applied primarily to banking organizations above $30B in total consolidated assets) excluding generative and agentic AI from its formal scope while still expecting such technologies to be governed, the record has to exist at the moment of the decision.  Trust Center · Security

Framework mappings describe technical control support and evidence capabilities. They do not constitute legal advice, regulatory certification, or a guarantee that a customer’s deployment is compliant. “SOC 2 Type II — In Progress” means an independent SOC 2 Type II audit is engaged (Decrypt CPA, via Scytale) and the observation period is underway; it is not a completed audit or an issued attestation.

governed decision · signed evidence record ✓ VERIFIED
decision_idDEC-00042
policylending_v1 · ECOA / Reg B
verdictBLOCK — adverse-action evidence required
content_hashsha256:3204f3d6…1ef0f3130
signaturekms-ecdsa-p384-3066…d914b8
Sample record · re-hash + ECDSA P-384 re-verify, no EVE service required Verify a record offline →

Multi-Tenant SaaS

Available now
Fastest path to value. EVE-hosted and tenant-isolated; you connect your model providers and start governing in minutes.
Runs in
EVE cloud (AWS)
Your data
Tenant-isolated; signed evidence per org
Model keys
Bring-your-own, AES-GCM encrypted at rest
Best for
Pilots, Pro / Team tiers, fast evaluation
Your app ─▶ EVE SaaS ─▶ your model │ signed evidence ─▶ /verify

Customer VPC

Design-partner deployment
EVE deployed inside your own AWS / Azure VPC. Prompts, outputs, and evidence never leave your network boundary.
Runs in
Your VPC / subscription
Your data
Never leaves your VPC
Model keys
You hold them; EVE never sees plaintext
Best for
Regulated mid-market, data-residency rules
┌─ Your VPC ─────────────┐ │ app ─▶ EVE ─▶ model │ │ └▶ evidence │ └────────────────────────┘

Private Cloud

Design-partner deployment
Dedicated, single-tenant EVE in your cloud account with full network isolation and your own key management.
Runs in
Dedicated tenant, your account
Your data
Single-tenant isolation, no shared infra
Model keys
BYO HSM / KMS for evidence signing
Best for
Large regulated banks, insurers, health systems
Your cloud account └─ dedicated EVE + HSM/KMS └▶ ECDSA P-384-signed evidence

On-Prem / Air-Gapped

Design-partner engagement — not yet generally available
EVE runs in your datacenter — optionally fully air-gapped — governing local / on-prem models with zero external calls.
Runs in
Your datacenter
Your data
Never leaves the premises; air-gap option
Model keys
On-prem HSM; offline evidence verification
Best for
Defense, government, top-tier banking
Air-gapped datacenter app ─▶ EVE ─▶ local model └▶ evidence (offline verify)

The same guarantees in every model

Deployment changes where EVE runs — never what it proves. The evidence contract is identical everywhere.

✓
Signed decision evidence
ECDSA P-384-signed over a deterministic content hash — every governed decision.
✓
Independent verification
Auditors verify against the published key at /verify — no EVE account, no trust required.
✓
Tenant isolation
Org-scoped governance, evidence, and policy — enforced at the kernel, not the request body.
✓
Bring-your-own keys
Per-tenant model credentials (AES-GCM at rest) and BYO HSM/KMS for evidence signing.
✓
Deterministic replay
Any decision re-evaluates to the same verdict — provable reproducibility for examiners.
✓
Supply-chain provenance
SLSA build attestation and a CycloneDX SBOM ship with the platform.
See it govern a real decision → Verify our evidence Talk to us about deployment

SaaS is generally available today. VPC, Private Cloud, and On-Prem are delivered through design-partner and enterprise engagements — contact us to scope your environment.