Customer-hosted infrastructure
Where the engagement uses customer-hosted infrastructure, the customer retains control of that infrastructure and its associated access policies.
Security & trust
Keep the assurance boundary explicit.
Shyena focuses on technical evaluation, evidence and governance workflows. Security and data-handling responsibilities remain explicit between Shyena, the customer and the infrastructure or model providers involved.
Access
The default engagement boundary is a customer-controlled test or staging environment. Shyena uses the minimum access needed for the agreed assurance scope, prefers scoped API credentials and read-only log access, and does not require production access for an initial assessment. Any production access is explicitly scoped and agreed in advance.
Customer-funded LLM/API usage
LLM and API usage is funded by the customer and remains subject to the terms and controls of the selected providers.
Data handling
The public website does not use an application database for contact submissions. Contact-form data is sent to Resend for email delivery and is delivered to Shyena's contact mailbox. The Vercel-hosted application processes the request while the function is running and does not intentionally maintain a separate customer-data store. For assurance engagements, data is limited to the agreed scope and customer-controlled environments are preferred; customer data should not be supplied unless required for the test. Deletion and retention requirements for engagement data are agreed in the applicable contract or DPA.
DPA
DPA available on request. Where personal data is processed on behalf of a customer, applicable data-processing terms should be agreed before processing begins.
Certifications
Shyena does not currently hold SOC 2 or ISO 27001 certification.
Governance positioning
Mapped evidence, not compliance promises.
Shyena can map evaluation evidence to relevant AI governance requirements, including the EU AI Act and ISO/IEC 42001. This is a technical evidence workflow, not legal advice, a certification service or a guarantee of regulatory compliance.
EU AI Act
Technical evidence can be organised against relevant obligations and controls.
ISO/IEC 42001
Evidence can be mapped to relevant AI management system controls.
Security testing
Adversarial scenarios, control checks and reproducible findings can be preserved as evidence.
Shyena provides technical evaluation and evidence. It is not legal advice and not a certification body.
Discuss your assurance scope