01Home02About03Divisions04Operations05Governance06Newsroom07Careers08Contact
Noctara Enterprise, Inc. · United States · Canada · Pakistan · Philippines

Held to the standard
we sell to everyone else.

SeraphisAI exists because institutions cannot prove what their models are doing. It would be indefensible not to run the group on it.

OversightBoard-level, independent line
FrameworksEU AI Act · NIST · ISO · SOC 2
Evidence retentionSeven years
Reporting channelConfidential, outside management

Six policies with teeth.

Each one is enforced by a system or a named office, not by a document that nobody reads after induction.

P-01

Model governance

No model reaches a customer without a registered owner, an evaluation, a rollback path and a retention policy. Enforced in the request path, not by a checklist.

P-02

Data protection

Regional data is processed by the regional entity. Transfers are logged at record level and revocable by the data subject.

P-03

Human oversight

Any automated decision affecting a person carries a named reviewer and an appeal route. Automation relocates accountability; it never removes it.

P-04

Security

Least-privilege access, mandatory review on production change, annual third-party penetration testing. ISO/IEC 27001 aligned throughout.

P-05

Supplier & labour standards

Manufacturing partners are named publicly and audited. Contracts terminate on a failed audit, not at the next renewal.

P-06

Speaking up

A confidential channel runs to the General Counsel and the Board, outside subsidiary management. Retaliation is a terminable offence.

0
Regulatory frameworks mapped to controls
0
Models registered before customer exposure
0
Years of evidence retention
0
Independent risk line to the Board

What we map to, and what that means.

EU AI Act
Obligations mapped to testable controls; evidence exportable per system.
NIST AI RMF
Govern / Map / Measure / Manage functions implemented across the group.
ISO/IEC 42001
AI management system structure adopted as the group's internal standard.
ISO/IEC 27001
Information security controls aligned across every operating company.
SOC 2 (Type II)
Trust services criteria tested continuously for platform products.
GDPR / regional law
Regional processing, documented transfers, subject rights honoured at entity level.

Alignment describes implemented control structure. Where a formal certification or attestation has been completed, the report is named and dated in the data room. Never implied by a logo on a marketing page.

Two footprints worth measuring.

We have two material environmental exposures: compute and garments. We measure those and leave the rest alone.

Compute. Inference is scheduled against regional grid intensity, and model efficiency is treated as a cost line. That is the version that actually gets optimised.

Garments. Limited runs mean we do not make inventory we expect to destroy. Factories are named and audited with every release.

We do not claim carbon neutrality, and will not until the measurement behind it would survive an audit.

Ask us for the evidence.

Security documentation, control matrices, insurance certificates and entity registrations are released to qualified counterparties under NDA.

Request documentationGroup structure