RamAInSecurity
Contact security
Security at RamAIn

Your systems stay yours.Agents borrow access per task.

RamAIn's digital workers sign in to the software your teams use, with accounts your IT team issues. Here is where your data lives, how an agent connects, what happens during a run and what remains after it.

Request the security packCommon questions
Your systems, data, recordings and audit trail stay on your side. RamAIn holds orchestration, the credential vault and AI inference. They meet only inside one isolated run, which is destroyed when it ends.Your sideBusiness systemsCRM, ticketing, internal toolsBusiness dataNever copied out long termRecordings, audit trailEvery run, kept by youYour IT controls accessRamAIn sideOrchestrationStarts runs of approved SOPsCredential vaultAES-256, decrypted at useAI inferenceZero retention, no trainingNo long-term copy of your dataOne runisolatedDestroyed when thetask endsservice accountin memory onlyrecordedstarts runcredential at useprompts
ISO 27001
ISO/IEC 27001:2022 certified
SOC 2
Type II, no exceptions noted
AES-256
Credential vault at rest
TLS 1.2+
On every connection
72 hours
Incident notification
Where everything lives

Your data stays on your side.Our infrastructure sits on ours.

The agent only meets your data inside a short-lived, isolated environment that exists for one task and is destroyed when it ends.

What sits there
Your side

Your systems and business data. The session recording and audit trail of every run.

RamAIn side

The platform: orchestration, the short-lived execution environments and the encrypted credential vault.

Who controls it
Your side

Your IT team: accounts, permissions, network rules and retention.

RamAIn side

RamAIn: platform security, patching, monitoring and vulnerability management.

What does not happen
Your side

No RamAIn software on your laptops or servers. No laptop, VDI or VPN issued to RamAIn.

RamAIn side

No long-term copy of your data. No model trained on it.

How an agent connects

Service accounts, not people.Least privilege, revocable at any time.

No laptop, VDI or VPN is issued to RamAIn. The agent signs in like a member of staff, through an account your IT team controls.

01

Service accounts, not people

The agent signs in through a dedicated service account your IT team provisions, restricted to RamAIn's IP addresses. Every action is attributable to the agent, not to an employee.
02

Least privilege

The agent gets exactly the access a person doing the same work would get, and nothing more. Your IT team can revoke it at any time.
03

Vaulted credentials

Credentials are encrypted at rest with AES-256 and decrypted only at the moment of use. The AI model never sees a raw password, key or token.
04

Its own second factor

Multi-factor prompts go to the agent's own phone number and email address, so no employee's second factor is ever shared.
05

Encrypted in transit

Every connection uses TLS 1.2 or higher, between the platform, the execution environment and your systems.
06

Nothing on your machines

Agents run entirely in the cloud. Nothing is installed on, or takes control of, an employee's device.
During a run

One task, one environment.Destroyed when the task ends.

Each run starts a fresh, isolated virtual environment with no path to other runs, other customers or your wider network, so it cannot become a foothold.

  1. 1

    Triggered

    A ticket, email, schedule or person starts a run of an approved SOP.

  2. 2

    Isolated

    A fresh virtual environment is created for this run alone, with no path to other runs, customers or your wider network.

  3. 3

    Signed in

    The service-account credential is decrypted from the vault at the moment of use.

  4. 4

    Bounded

    The agent works only in the systems and data the SOP allows. Checkpoints can hold irreversible steps for a person.

  5. 5

    Recorded

    Outputs are written to your systems. The session recording and step-by-step audit trail are saved.

  6. 6

    Destroyed

    The environment and everything in it are deleted when the task ends.

What persists
The SOPThe approved procedure the agent follows. Yours to read, edit and retire.
Session recordingScreen by screen, for every run, successful or not.
Audit trailEach step and decision, with the agent's reasoning, reconcilable against your systems' own logs.
Vaulted credentialsEncrypted service-account secrets, until your IT team revokes them.
What does not
Workflow dataHeld in memory only while the agent runs, then deleted with the environment.
Model inputsInference runs under enterprise zero-retention terms.
Training dataYour data never trains RamAIn's or any third party's models.
Cross-customer dataEach enterprise has a separate tenant and execution environments; nothing crosses between customers.
Oversight

Your people stay in charge.Every step is on the record.

The SOP defines which systems and data an agent may use. You decide where a person signs off.

01

Human checkpoints

Place an approval before any irreversible action. Exceptions route to a named person instead of being guessed at.
02

Build, approve, promote

Agents are built and tested in development and reach production only after a designated approver signs off.
03

Drift detection

Each run is checked against its SOP. A changed screen or missing input is flagged and recorded against the run.
04

Two audit trails

Every action appears in RamAIn's audit trail and in the target system's own logs, so the two can be reconciled.
Certifications and assurance

Independently audited.Shared under NDA.

The SOC 2 Type II report, ISO certificate and information security policies are available under a mutual NDA. Ask security@ramain.ai.

ISO/IEC 27001:2022

Certified

Certified by InterCert. Certificate IC-IS-2601224, valid to 18 January 2027.

SOC 2 Type II

Attested

SSAE 21 report on Security, Availability and Confidentiality, 1 February to 1 May 2026. No exceptions noted.

Data protection

DPA

Data Processing Agreement covering GDPR, UK GDPR, India's DPDPA 2023 and CCPA/CPRA, with EU SCCs (Module Two) and the UK transfer addendum.

Incident notification

72 hours

Notification without undue delay and within 72 hours, with updates through to closure.

Sub-processors

Disclosed

Listed in full in the Data Processing Agreement, with 30 days' notice of any change.

Deployment

Hosted by RamAIn,or inside your own cloud.

Both run the same architecture and controls. Which suits you is usually settled with your architects early in the review.

Recommended

Hosted platform

RamAIn's audited, hosted platform with tenant isolation, managed keys, monitoring and a replicated disaster-recovery region. It keeps routing across models, so agents stay on the most suitable model as new ones ship.
Available

Your cloud or on premises

The same architecture inside your own AWS, Google Cloud or Azure environment, or on premises, with the network, keys and audit trail under your control.
Questions security teams ask

Straight answers.Ask us for more.

Anything not covered here, email security@ramain.ai.

Does the AI model ever see our passwords?

No. Credentials stay in the encrypted vault and are decrypted only at the moment the agent signs in. The model that plans the work never receives a raw password, key or token.

Is our data used to train models?

No. Inference runs under enterprise zero-retention, no-training terms, and your data is never used to train RamAIn's or any third party's models, or combined with another customer's.

Do agents get around MFA or other controls?

No. Agents sign in the way your staff do, with accounts your IT team issues. One-time codes go to the agent's own phone number and inbox. Where a step needs a person, the run pauses and asks one.

How do we cut off access?

Disable or rotate the service account in your identity system. The agent holds no other way in, and nothing of RamAIn's is installed on your network.

Can we see exactly what an agent did?

Yes. Every run produces a full session recording and a step-by-step audit trail, including runs that fail, and both can be checked against your systems' own logs.

How do we get the SOC 2 report and ISO certificate?

Both are shared under a mutual NDA. Email security@ramain.ai or ask your RamAIn contact.

How do we report a vulnerability?

Email security@ramain.ai with the details and steps to reproduce. Please give us a reasonable window to fix the issue before disclosing it.

Bring your security team.We will walk through all of it.

Reviews, questionnaires and architecture calls go through security@ramain.ai. Data protection questions go to privacy@ramain.ai. Last updated 22 October 2026.

security@ramain.aiprivacy@ramain.ai