# Trust - Compliance, Data Handling & Sub-processors | Ankra Canonical: https://ankra.ai/trust Ankra's trust page for buyers and compliance teams: our honest SOC 2 posture, what data the control plane stores, and the sub-processors behind the platform. Trust # Know what you are trusting. The material your team needs to evaluate Ankra: compliance status, data handling, sub-processors and the platform’s security controls. [Read the documentation](https://docs.ankra.ai/security/overview) [Talk to our team](mailto:hello@ankra.ai) Compliance ## Where we are on SOC 2, honestly No badges we have not earned. Here is the actual state of the programme and what already exists for your auditors. Current status ### SOC 2 audit in progress Our SOC 2 audit is in progress. We are building an information security management system against the SOC 2 Trust Services Criteria, and this page will say so the moment the report is issued. If a vendor questionnaire needs more than what is published here, ask us directly. [Request current security documentation](mailto:security@ankra.ai) ### What auditors can use today The evidence trail is not waiting on a certificate - it is built into how the platform works: - Append-only audit log covering every administrative change - Role-based access control with built-in and custom roles - Attributed Git history - every change traces to an author, SHA, and timestamp - Exportable evidence, per organisation Data handling ## What we hold, and what we never see The control plane works from metadata and encrypted credentials. The heavy, sensitive material stays inside your cluster. ### What the control plane stores - Cluster, stack, and organisation metadata - Credentials, encrypted and held in Vault - Audit events for every administrative change ### What never leaves your cluster - Container image contents and scan targets - scanning runs in-cluster, and images reach Ankra only when you build with Ankra's hosted builders or push to Ankra's registry - Unredacted logs - redaction happens at the source, before anything is sent - Plaintext SOPS secrets - decryption happens inside your cluster ### Data residency - The platform is operated by Ankra AB (Sweden), under licence from Ankra UK LTD - Product analytics runs on PostHog's EU-hosted cloud - The control plane and its databases run in Finland, with a warm standby in a second Helsinki data centre - Platform database backups are kept in Germany; the full list of providers and locations is below How we handle personal data is covered in our [privacy policy](https://ankra.ai/privacy) . Sub-processors ## Who processes data on our behalf The third parties we rely on to run the platform. We keep this list short on purpose. Sub-processor Purpose UpCloud (Finland) Control-plane hosting, its databases and Ankra's hosted build workers, Helsinki data centres (primary and warm standby) Hetzner (Germany) Ankra container registry service (registry.ankra.cloud) and platform log search Amazon Web Services Image storage for the Ankra container registry (London, United Kingdom) and encrypted platform database backups (Frankfurt, Germany) DigitalOcean (Germany) Encrypted platform cluster backups, Frankfurt Auth0 (EU tenant) Identity and authentication Stripe Payments and billing PostHog (EU) Product analytics, EU-hosted, consent-gated Sentry Error monitoring OpenRouter LLM routing for AI features on platform-managed keys Groq LLM inference for AI features on platform-managed keys Voyage AI Embeddings for AI search and retrieval Google Workspace Transactional and support email Mintlify Documentation hosting When your organisation brings its own model API keys, AI requests go directly to the provider you chose and our AI sub-processors are not involved. Our [Data Processing Agreement](https://ankra.ai/dpa) applies to every customer automatically; changes to this list are notified 30 days in advance under it. Signed copies: [privacy@ankra.ai](mailto:privacy@ankra.ai) . Go deeper ## The detail behind this page The technical controls, and the product documentation that backs every one of them. ### Technical controls The full controls matrix - identity, the AI surface, secrets, audit, cluster hardening, and vulnerability management - with the status of each control and the architecture behind them. [Read the security page](https://ankra.ai/security) ### Product documentation How each control works in practice - configuring MFA and roles, SOPS encryption, the audit log, cluster security, and the MCP server. [Open the docs](https://docs.ankra.ai/) Your next chapter ## You built it. *Let’s get it live.* Give your application a path to production. Give your team a simpler way to run it. [Get your app live](https://platform.ankra.app/auth/signup) [Try a playground](https://ankra.ai/playground) First 30 vCPU of platform usage included. Try it without a card; a card unlocks full access and €59 of credit. From something you built to something people use. - Deploy from your repository - Run on infrastructure you choose - Operate with your team and agents