← Back to Vertiva Resources
Bottom Line
Compliance is a continuous, cross-cutting program that starts on day one, not a feature bolted on at the end. Self-hosted inference means customer content — including PHI/PII — never has to leave the customer's own environment.
Certification & Framework Coverage
| Framework | What It Requires |
|---|---|
| SOC 2 Type II | Continuous evidence over a 6–12 month observation window |
| HIPAA | Signed BAAs before any PHI is processed |
| ISO 27001 / 42001 | Information security and AI management system controls |
| EU AI Act / NIST AI RMF | Risk classification and structured risk-management alignment |
Data Sovereignty Is the Differentiator
Self-hosted inference removes the AI vendor as a subprocessor entirely, collapsing the HIPAA and GDPR surface area in one architectural move rather than through incremental controls.
Governance Capabilities Built on Top of the Controls
Lineage & grounding: no answer is served without a citation back to its source.
Guardrails: enforced checkpoints for prompt injection, toxicity, and PII egress.
Right-to-be-forgotten: a verifiable deletion cascade across every store and cache.
Audit & evidence automation: compliance evidence generated on demand, not under pressure.