Trust & compliance

Haihtuva is a confidential, AI-assisted due-diligence room built so that your documents are processed in protected memory and are not kept by us. Haihtuva means "vanishing" in Finnish: what is processed is meant to disappear.

How we protect your data

• Documents stay with you. The room reads files read-only from your own storage, on demand, and does not copy them into our storage.
• Confidential computing. Each room runs on its own Microsoft Azure confidential virtual machine with hardware-encrypted memory. The room's key is released by Azure Key Vault only after Microsoft Azure Attestation confirms a genuine confidential machine. You see the result of each check in the room.
• RAM-only processing. Room data is held in memory, released after use and never written to disk in plain form. Optional search-index snapshots and recovery copies are encrypted with the room's attested key.
• Encryption in transit (HTTPS) and in use (memory encryption); AES-256-GCM for any encrypted copy.
• Strong sign-in. Every user has a password and an authenticator app (two-factor authentication is mandatory).
• Separation. Sellers and each buyer work in separate lanes; buyers never see each other's work.
• No operator access to content. Our staff are not given functions, credentials or keys that show your documents, questions or results in plain text.
• No training on your data. We do not use your content to train AI models.
• Content-free monitoring. Misuse alerts go to your own administrators; we receive only the room, rule, severity and time.
• Verified deletion. At the end of a room its data and keys are destroyed and both sides receive a signed destruction receipt.

Where you approve an AI model that runs outside the room (for example a hosted model), the text needed for each request is sent to that model's endpoint in the region shown in the room's Security Specification, under that provider's terms. You see and approve this before any work starts.

Where data is hosted

Rooms run in Microsoft Azure EU regions. US hosting (Microsoft Azure US region) is coming soon; US customers can pilot today with EU processing.

Compliance

• CSA STAR: Haihtuva is listed on the Cloud Security Alliance STAR Registry at Level 1 (self-assessment), approved on 17 October 2026: Biotech Start-Up Management Ltd, Haihtuva. The assessment follows CAIQ v4 and the Cloud Controls Matrix v4 and is also published here as our cloud security self-assessment. STAR Level 1 is a self-assessment: it is not an audit, a certification or a third-party attestation. The completed CAIQ v4 questionnaire is available on request.
• SOC 2: SOC 2 readiness programme initiated; independent audit not yet performed.
• HIPAA: HIPAA readiness programme initiated; Haihtuva currently accepts de-identified data only and does not sign BAAs. Please do not upload protected health information.
• GDPR: we act as processor for your content under a data processing agreement (Schedule 1 of our Terms of Service), and as controller only for account, acceptance and security records described in our Privacy Notice.

Sub-processors

We give notice of intended changes to sub-processors.

Security questions and responsible disclosure

Security and privacy questions, and reports of suspected vulnerabilities: juhani.lahdenpera@bsum.fi .

If you believe you have found a vulnerability, please write to us with enough detail to reproduce it. Please do not access other users' data, degrade the service or run automated scanning without our written permission, and give us reasonable time to fix the issue before disclosure. We will acknowledge your report and keep you informed.

Biotech Start-Up Management Oy, Business ID 2574531-6, Vanhatie 70, 86100 Pyhäjoki, Finland.