01Roles & responsibilities
Self-hosting collapses the usual controller/processor split onto you: you decide the purposes, and you also operate the software that does the processing.
| Role | Who | What they touch |
|---|---|---|
| Data controller | You | Decide why employee AI usage is processed; own the lawful basis, notices, and data-subject requests. |
| Processor | Anyray software, running in your environment | The gateway, optimizer, console, and Postgres — all on your infrastructure. No vendor-side store of your content. |
02Regulatory standing
The system ships the controls — encryption at rest, access control, audit trails, data-subject-request endpoints, and retention knobs — while the certification and attestation program for your deployment remains yours, since the software runs in your environment.
The article-by-article GDPR standing and the SOC 2 control mapping (CC3 risk assessment, CC6 access, CC7 monitoring) are set out on the Risk Assessment page.
03Shared responsibility
Anyray holds its own SOC 2 Type I attestation and ships the controls for your deployment. The deployment hardening and organizational process remain yours.
| Area | Anyray ships | Your program owns |
|---|---|---|
| SOC 2 | Encryption at rest, access gates, append-only audit trails, DoS brakes. | Organizational policies and personnel controls; vendor & change management for your deployment; monitoring, alerting, and incident response (route the audit logs to your SIEM); backups / disaster recovery; host-level disk encryption. |
| GDPR | Data-subject-request endpoints, content-free stores by design, retention controls. | Lawful basis and employee notices; the DPIA, sized to your trace-retention window; processor agreements — including with your upstream LLM providers, which receive prompts; breach detection and notification procedures. |
04Audit trails SOC 2 CC6 / CC7
Every admin mutation is recorded as append-only JSONL (timestamp, actor, action — metadata only, never content). There is no single audit stream: each admin domain writes its own file, so you can route them independently to your SIEM for alerting and tamper-evident retention. The recorded domains include data-subject requests, content-mode changes, client- and provider-key lifecycle, routing, and the control-plane account lifecycle.
05Certifications & artifacts on request
Anyray holds a completed SOC 2 Type I attestation (as of 6 July 2026, examined by Securance Pro Assurance PLLC), with a SOC 2 Type II examination in progress; its controls are additionally mapped to ISO 27001 criteria. The SOC 2 report and supporting trust materials — the risk register, control-maturity ratings, and full asset inventory — are shared under NDA on request. Reach your Anyray contact or app.anyray.ai.
06Contact
Email: hi@anyray.ai