Security & Compliance
The public agent structurally cannot decrypt PII. Not “designed not to” — cannot. Its credentials don’t authorize vault reads. This page is the architecture we’ll walk through in your vendor review.
In plain English
- Your data never leaves your cloud account — we deploy inside your VPC.
- The agent that runs every day cannot read personal data — by construction, it only ever sees tokens.
- Every time a human needs the real value, it is logged — with a name and a written reason.
The two-tier model
Public tier — 95% of usage
Sees tokens only, never raw PII
Read-only analysis tools
Auto-approved — fast for daily ops
Privileged tier — KYC & disputes
PII via vault reveal only
Human approval on every call
Written justification required
Between them: a Fernet-encrypted vault with its own IAM principal — and an access log of every reveal.
The four invariants
- Tokenize at ingest. Raw PII never lands in a fact table — the lakehouse stores deterministic HMAC-SHA256 tokens.
- The vault is separate. Different database, different IAM principal. The public agent’s IAM has no read on the vault.
- Egress redaction on every response. Presidio scans and scrubs every public-tool return; anything PII-shaped is blocked and raises a P1 alert.
- Human-in-the-loop on every reveal. Explicit approval plus a written justification — both logged with the operator identity.
The chaos test
We inject a known email and phone number into a payload and assert two things: they never reach the output, and the alert log caught the attempt. It runs live in your vendor review. If it ever fails, we don’t ship.
Compliance posture
| Regime | Posture |
|---|---|
| PCI | Out-of-scope by design — no PAN ever in transit or storage; we read processor settlement records, not card numbers |
| GDPR Art. 32 | Encryption at rest, access logging on every reveal, right-to-erasure = delete the vault row |
| GLBA | Non-public personal information confined to the vault, behind a separate IAM principal |
| SOC 2 | Every PII access has actor + justification + timestamp — exportable as CSV for auditors |
| HIPAA | Vault-ready — encryption at rest aligned to HIPAA technical safeguards; egress filter blocks PHI patterns |
In your stack
| Component | Production form |
|---|---|
| Vault | Skyflow, HashiCorp Vault, or KMS-backed Postgres — same interface, replaceable backend |
| Keys | AWS / GCP KMS with quarterly rotation; tokens stay stable across rotations |
| Identity | Audit attribution from your SSO’s OIDC subject claim |
| Approvals | Slack approval flow with your on-call rotation |
| Redaction | Presidio plus custom recognizers for your account-number formats |
Working with Soleil
- Every build ships with SOC 2-ready logging and PII isolation. We walk your security team through the architecture and run the chaos test live in your vendor review.
- Data-processing and business-associate terms are scoped with your compliance lead before any data moves.
- Official Databricks partner. Member of the Claude Partner Network. Senior engineers only — the people in the review are the people who build.