Compliance and Trust Center

Certifications API7.ai maintains, how to request compliance reports and a Data Processing Agreement, and where the underlying security controls are documented for AISIX.

This page is the starting point for a security or compliance review of AISIX: what API7.ai maintains at the organization level, how to request the reports an audit needs, and where the controls behind them are actually documented so this page does not have to restate them.

Certifications and Reports

API7.ai maintains a formal security program covering its products, including AISIX. For current certification status, audit reports, or a compliance attestation for your procurement process, contact your API7 account manager or sales@api7.ai.

Data Privacy and Data Processing Agreements

For questions about how API7.ai protects customer data, its approach to global privacy regulations such as GDPR, or to request a Data Processing Agreement (DPA), contact your API7 account manager or sales@api7.ai. Products and Deployment Options describes which AISIX deployment options keep your AI traffic and which parts of your configuration reach an API7-operated control plane — review that alongside a DPA request so the scope matches your actual deployment.

The Controls Behind the Review

An auditor's questions about AISIX are mostly answered by feature documentation that already exists elsewhere. This page does not restate it:

Control area	Where it is documented
Encryption in transit — mTLS between gateways and the control plane	High Availability, TLS and mTLS
Encryption at rest — envelope-encrypted secrets and master-key rotation	Master Key Rotation, On-Premises Configuration
Credential handling for upstream providers and callers	Credential Types Matrix, Provider Keys
Access control — organizations, teams, roles, admin tokens	Custom Roles, Admin Tokens
Audit trail	Logging and Auditing
Guardrail data flow to third-party content-safety vendors	Third-Party Guardrail Data Flow
Data residency — what reaches an API7-hosted control plane under Hybrid Cloud	Data Residency Matrix
Supply chain — image signing and SBOM requests	Supply Chain Security
Disaster recovery and backup	Disaster Recovery, Backup and Restore, RTO/RPO Planning

Security Contact and Vulnerability Reports

To report a security concern or ask about API7.ai's security practices, contact security@api7.ai. Your API7 support representative can also route you to the right team for a specific advisory or compliance document request.

Next Steps

Supply Chain Security — verify image signatures and request an SBOM.
Data Residency Matrix — what data reaches the control plane under each AISIX deployment option.
Master Key Rotation — rotate the encryption key that protects secrets at rest in a self-hosted control plane.