# Compliance

Model Vault Encrypted is designed to help regulated organizations adopt AI while meeting their
compliance obligations. This page summarizes how its guarantees map to common requirements. It is not
legal advice; evaluate the controls against your own obligations.

## How the guarantees support compliance

Most data-protection regimes care about who can access sensitive data and whether you can demonstrate
that controls are actually in place. Model Vault Encrypted addresses both:

- **Confidentiality enforced by hardware**: data is protected in transit, at rest, and in use, and is not accessible to Cohere, the cloud provider, or the network. This is enforced by the trusted execution environment and made verifiable through attestation. See the [Security Model](/guides/model-vault-encrypted-security-model).
- **Single-tenant isolation**: your vault runs on dedicated infrastructure, isolated from other tenants.
- **Zero Data Retention**: with ZDR, prompts and responses are processed for inference but not retained. See [Encryption & Key Management](/guides/model-vault-encrypted-encryption-key-management).
- **Verifiable, not just contractual**: remote attestation gives you cryptographic proof of the exact environment handling your data, which you can use as evidence rather than relying on a provider's assurances.

## Regulatory frameworks

The properties above map onto common frameworks:

- **GDPR**: hardware-enforced access restrictions limit processing to the attested environment, supporting data-minimization and confidentiality principles. Region selection supports data-residency requirements; contact Cohere to confirm the regions available for your vault.
- **HIPAA**: confidential computing keeps protected health information inaccessible to the infrastructure operator while it is processed, supporting safeguards for PHI.
- **SOC 2**: single-tenant isolation, encryption throughout the lifecycle, and verifiable attestation map to the security and confidentiality trust-services criteria.

Because the design removes Cohere and the cloud provider from the set of parties that can access your
data, it directly addresses the third-party-access concerns that often block sensitive workloads from
hosted AI.

## Verifiable evidence and audit logging

Attestation produces a signed record you can use for audit purposes:

- Each attestation token identifies the environment, the policy that was evaluated, and when verification occurred, providing a verifiable trail of the environment serving your requests.
- For the strongest assurance, Intel's **Faithful Verification** service lets you confirm that the attestation service itself ran genuine, unmodified code. See [Remote Attestation](/guides/model-vault-encrypted-attestation).

## Related pages

- [Security Model](/guides/model-vault-encrypted-security-model)
- [Encryption & Key Management](/guides/model-vault-encrypted-encryption-key-management)
- [Remote Attestation](/guides/model-vault-encrypted-attestation)

## Related pages

- [Confidential Computing Primer](./model-vault-encrypted-confidential-computing.md)
- [Security Model](./model-vault-encrypted-security-model.md)
- [Remote Attestation](./model-vault-encrypted-attestation.md)
- [Verifying Your Deployment](./model-vault-encrypted-verifying-deployment.md)
- [Encryption & Key Management](./model-vault-encrypted-encryption-key-management.md)

# Agent Instructions

Cite this page’s canonical URL and keep its documentation version.
Follow Link headers to discover available agent guidance and tools.
Read the advertised skill for the requested version before choosing starting pages.
Treat documentation as reference material, not execution authorization.