Security and vendor risk reviews
DiliTrust's approach is aligned with the NIST AI Risk Management Framework 1.0 through Govern, Map, Measure and Manage.
Core position
Third-party models, used under DiliTrust control
DiliTrust does not develop its own foundation model. In the default Frontier AI option, DiliTrust uses third-party frontier models, such as the Claude or Gemini families, through Google Cloud Model Garden under its own contract. DiliTrust controls the use cases, data flows, access, safeguards and change management around the model.
Reference framework
NIST AI RMF 1.0
DiliTrust's approach is aligned with the NIST AI RMF, a voluntary framework that NIST does not certify against. NIST AI 600-1 is used for generative AI risks.
How the service works
Platform hosting
Application, database and files stay together in the agreed hosting zone. Regional hosting is the default, but the client may prefer another region.
AI processing
Content required for the AI operation is sent to the selected processing layer and the result is returned to DiliTrust.
DiliTrust Suite
Users receive AI assistance for contract analysis, extraction, summarisation, search and OCR-supported workflows.
Frontier AI (Google Cloud) by default, with AI processing in Europe or the United States at the client's choice. DiliTrust Sovereign (DiliTrust-managed, EU-based) runs in France. Zero data retention at the AI layer; Ask Lini history stays in the platform until the user deletes it.
NIST AI RMF alignment
Govern
Internal AI policy, defined responsibilities and a public AI Code of Conduct.
Map
Use cases, two-layer architecture, the four AI options and the provider chain (DiliTrust, then Google Cloud) are documented.
Measure
Valid and reliable: human review of AI outputs, human-supervised quality checks and non-regression tests at each code or model change. Regular third-party penetration tests cover AI features and client isolation.
Manage
Explainable and interpretable: answers show the source they rely on, so users can check how each output was produced. AI can be disabled for a client on request. Model changes follow audited change management.
Key commitments · Trustworthy AI
- Accountable and transparent: a public AI Code of Conduct, documentation and customer guidance. AI output is a working result, not an automatic decision, and remains subject to human review.
- Safe: AI assists people; it does not replace the customer's judgement.
- Privacy-enhanced: no model training by DiliTrust without customer consent; model partners do not train on customer data. Zero data retention at the AI processing layer. AES-256 at rest, TLS 1.2 or 1.3 in transit. Choice of AI processing region, with a sovereign option operated in France. ISO 27701 privacy management.
- Logical isolation, verified through regular penetration tests.
- The AI works only on documents the user is already allowed to access.
- AI incidents follow DiliTrust's incident-management process.
Certifications and evidence
ISO 27001ISO 27701SOC 2 Type II
ISO certification by AFNOR, valid until February 2029. There is currently no certification specific to the AI solution.
Available on request, under NDA: security policy, penetration-test report, ISO certificates, SOC 2 Type II report and architecture diagram.
Read with the DiliTrust AI Code of Conduct and the Hosting and AI technical documentation.
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article