Image: AI-generated
Security
Regulation tells you what is permitted. Not what is appropriate.
Our customers entrust us with their organization’s data — on people, roles, costs and plans. That is the measure for how we build and how we work. Transforming an organization means working with its most sensitive information and at the same time with its most consequential decisions. Together, the two admit no trade-off.
Four bodies of standards. In place before the first customer asked.
Our control framework for development and operations is aligned with ISO/IEC 27001, ISO/IEC 42001, ISO/IEC 27701 and BSI C5. It is in place and in operation.
ISO/IEC 42001 was published in December 2023. We have built against it from the start — not because anyone required it.
Every customer gets their own container and their own database. Only the entrance is shared, where it is decided who you are and which organization you belong to.
Our security rules are not just written down in a policy. They are anchored in the software, and every change to it is checked automatically — some checks block the change, others only warn.
We apply the same discipline to our own information security that Orglith itself is built on: material decisions are derived, justified and reviewed before they are implemented.
We operate our AI features within an AI management system aligned with ISO/IEC 42001, and we build them in line with the requirements of the EU AI Act. For every AI system we write down, before deployment, what it does, where it can go wrong and what it must not do. Where individual people are concerned, it is not the machine that decides.
Every one of these principles is demonstrable in detail. We meet them in development and in the product, not just on paper.
Ask for the documents.
The security questionnaire, the data processing agreement, the architecture overview and the pentest and certification roadmap are all ready. You get documents, not a presentation.