PMO1 follows a defense-in-depth architecture, incorporating:

• No direct frontend access to LLMs or external APIs
• Centralized backend routing via a secure middleware gateway
• Policy enforcement and inspection prior to any data egress
• Isolation of administrative controls from operational workflows
• Sanitized content rendering to mitigate XSS and injection risks

This architecture materially reduces data leakage, unauthorized access, and misuse risk.

• Built-in Role-Based Access Control (RBAC) supporting administrative, operational, and audit roles
• Designed for integration with enterprise identity providers using SAML 2.0 / OpenID Connect (OIDC)
• Supports least-privilege access models and separation of duties

Authentication enforcement, MFA, and user lifecycle management are controlled by the customer’s identity provider.

• PMO1 does not collect or process customer data outside customer environments
• Supports privacy-by-design principles, including data minimization and pre-processing controls
• Includes mechanisms to detect and redact sensitive data prior to external API calls
• Enables customer-controlled data deletion and retention policies

Customers remain the data controller and are responsible for lawful processing decisions.

• SOC 2: Secure software development practices and audit-ready control design
• GDPR: Supports customer compliance through access control, deletion mechanisms, and data minimization
• HIPAA: HIPAA-capable when deployed in compliant customer environments; PMO1 does not act as a Business Associate
• EU AI Act: Provides logging, traceability, human oversight, and deployment guidance aligned with provider obligations

Operational compliance obligations are fulfilled by customers based on deployment context.

• PMO1 follows a clear Shared Responsibility Model:

• PMO1: Secure architecture, governance capabilities, documentation, and compliance enablement
• Customer: Infrastructure security, identity enforcement, encryption, monitoring, and regulatory execution

Note: PMO1 provides a self-hosted software platform and does not operate customer environments or process customer data. Actual security controls, compliance obligations, and regulatory outcomes depend on customer deployment, configuration, and operational practices. No representations or warranties are made regarding compliance with any specific law, regulation, or standard.