The AI you ship has to be trustworthy on its own terms.

This page is the security read on the AI systems we build and deploy. Authorization, behavior, change control, data flow. The work that lives in the model of how the agent operates and what it is allowed to touch.

The companion concern, securing your business while your people use AI day to day, lives one division over at Hexaxia Technologies. Acceptable-use policy. Employee training on what not to paste into a public model. AI-aware phishing defense. Vendor AI risk inside the rest of your stack. That is vCISO work and we run it jointly from there.

Same problem, two layers, both required. A model that is secure on its own terms cannot save a company whose people do not have a policy. A perfect policy cannot save an agent that authorized itself into a system it was never meant to touch. We carve the work cleanly between the two divisions instead of pretending one side covers everything.

Every AI system we deliver runs on three internal frameworks we wrote and maintain. AGF, APF, and ASIP. They are not three open-source repos. They are the institutional rules we run our own shop on, and the same rules your team sees in detail during onboarding. See the full breakdown.

Read as a security posture, each one closes off a specific failure mode that wrecks AI in production.

The frameworks above govern the agent. Data exposure governs what the agent gets to see in the first place. Two separate questions, often collapsed into one and answered badly.

For every system we ship we name what leaves your network, what does not, what vendor sees it, and what their retention policy looks like. Retrieval is grounded against a corpus you control, not against the open internet. Sensitive classes get scoped out of prompts, not redacted after the fact. Audit trails record what was sent and what came back, so a question six months later has an answer.

When the vendor risk is unacceptable, we move the work on-prem. That is part of why Doxia exists and why on-prem AI is on the product horizon. See the lineup.

A secure AI system cannot save a company whose people do not have a policy. Most of the real-world AI security incidents of the last two years were not exotic adversarial attacks. They were employees pasting customer data into public models, attackers using AI to write better phishing, vendors quietly training on the data your team uploaded.

That side of the work lives at our sister division. The vCISO seat at Hexaxia Technologies covers acceptable-use policy for AI in your business, employee training on what to do and what not to do, AI-aware phishing and social defense, and vendor AI risk inside the rest of your stack. Same governance discipline, applied to the human layer instead of the implementation layer.

We run engagements jointly when both layers are in scope. The handoff is named, the policy framework is the same one covering the rest of your security program, and the two sides do not contradict each other.