How we handle your data,
written down in plain terms
Which certifications we plan to get and when, where customer data is processed, and the rules our AI verdicts follow.
When any of this changes, we update this page first.
Certifications: none held yet
As of 2026.11.07 Everything below is in preparation or planned. We will not say "certified" until we are.
Security control design
Isolation architecture, access control and audit logging
ISO/IEC 27001 audit
Information security management system and internal audit
SOC 2 Type II observation period
Evidence of security and availability controls in operation
ISMS-P and ISO/IEC 42001
Korean management system certification and AI management system
Until certifications arrive, we answer security questionnaires and due diligence requests directly. Email admin@genox.one.
How customer data is handled
Not used for training shared models
Customer data is never used to train shared models or to analyse other customers.
Where it is processed
On-premises installs process data inside your data centre. Dedicated cloud uses a separate tenant per customer in a Korean region.
Every transfer is logged
Each data transfer leaves a record that you can read yourself.
You set retention
You decide how long analysis data is kept and when it is deleted.
Staff access is limited
Genox staff need approval for each access to customer data. Access expires after a set time and is logged.
Korean data stays in Korea
Data of Korean customers is kept in Korea. If it ever has to move abroad, we ask for consent first.
Rules our AI verdicts follow
No evidence, no verdict
Every verdict is recorded together with its evidence, reasoning and confidence.
Past verdicts can be re-run
We store the data, model version and policy version used for each verdict, so it can be re-run under the same conditions and compared. Wording may differ between runs. If the verdict itself changes, the difference is recorded.
People approve high-impact actions
Automatic response only runs inside the policy agreed with you. Isolation, blocking and account locks outside that policy need an analyst's approval.
False positives and misses are reported
Monthly customer reports for the full service will include false positive rates and missed cases. Before launch, we have published how we will measure them on the AI quality page.
How Genox itself is secured
| Dedicated servers per customer | Analysis runs only on servers set aside for that customer |
| Network policy | Deny by default, open only allowed connections, log every connection |
| Encryption | Encryption at rest and in transit, customer-managed keys (planned) |
| Audit logs | Signed logs kept in tamper-proof storage |
Found a vulnerability in Genox?
Please tell us.
We will not take legal action against researchers who report in good faith and follow the rules here, and we will get back to you once we have checked it.
How to report
- Email admin@genox.one with steps to reproduce and the impact.
- Please allow at least 90 days for a fix before disclosure.
- Do not run tests that access customer data or disrupt the service.