Skip to content
Salvus AI
Trust

How we work, the technical side.

This page is for the IT lead, the compliance officer, and the executive who has been burned before. If you are in a regulated environment, healthcare, dental, financial services, or anywhere PHI or sensitive data is in play, this is where the architecture lives.

Talk to John about your environmentBook a Systems Audit
Salvus AI infrastructure architecture for enterprise and regulated environments
The technical model

One client per deployment.

For enterprise and regulated engagements, Salvus deploys per-client isolated infrastructure. Each client gets a dedicated VPS provisioned for that engagement. No shared databases, no shared model accounts, no shared secrets.

  • 01VPS

    Dedicated infrastructure

    DigitalOcean droplet provisioned for your engagement, in a region you choose. The droplet is in your name where billing allows, in our name with documented transfer rights otherwise.

  • 02MCP

    Isolated MCP server

    We deploy a Model Context Protocol server on your VPS, locked behind bearer-token auth and HTTPS. Each client has a completely separate server. Nothing is shared across engagements.

  • 03Logs

    Auditable request log

    Every model call logged with timestamps, tool arguments, and outcome. Stored on your VPS. Exportable in plain CSV or JSON whenever your team or auditor asks.

  • 04Keys

    Your access keys

    API keys, OAuth secrets, and environment variables live on infrastructure you can audit. We rotate, you observe. We never store credentials in any system you cannot see.

  • 05Models

    Pluggable AI providers

    OpenAI, Anthropic, xAI, Google, Meta: your compliance posture drives the model selection, not our vendor preference. We pick the provider whose data terms match your requirements.

  • 06Incident

    Incident response

    If something breaks, you hear from us before you hear from a customer. Every incident logged, post-mortem written, fix shipped on a clock you can hold us to.

Deployment process

From provisioning to production in 30 days.

Regulated environments need a documented process, not a promise. Here is exactly how an isolated deployment goes from signed agreement to production go-live.

  1. 01Days 1 to 5
    Phase 01

    Inventory and scope

    We map every tool and workflow that touches sensitive data. Written scope delivered by end of week one. Nothing moves until we agree on the boundary.

  2. 02Days 6 to 14
    Phase 02

    Provision and harden

    VPS provisioned. Nginx configured, certbot installed, systemd unit running, monitoring active. Bearer-token auth wired in. Security baseline documented.

  3. 03Days 15 to 25
    Phase 03

    Integrations and testing

    Tool integrations built and tested against real data. Your team can run the test suite without us in the room. Audit log confirmed working before production.

  4. 04Days 26 to 30
    Phase 04

    Handoff and go-live

    Full runbook delivered. Named owners documented. On-call rotation set if you want one. Production go-live with signed attestation.

Data handling

Residency, retention, deletion.

Residency

Data lives on your VPS in the region you select at provisioning. We do not move it without a written request from your team.

Retention

Logs default to 90 days on the VPS. Longer retention is a config change, not a contract negotiation. You decide, we document.

Deletion on exit

When an engagement ends, the deployment is yours to keep, transfer, or destroy. Written deletion attestation on request, signed by the operator who ran the wipe.

Compliance

HIPAA engagements.

HIPAA is a paid add-on, not a marketing claim. If your engagement involves PHI, we scope the compliance requirements before any code is written.

What HIPAA coverage includes

BAA signed before PHI touches any system. Dedicated VPS with encrypted storage. Audit log of every model call involving patient data. Incident response with regulatory notification timeline.

How HIPAA is scoped

HIPAA is scoped as a line item on top of the base engagement and quoted in writing. The compliance layer has real costs: encrypted storage, additional testing, documentation, and ongoing audit support. Every one of them is spelled out before you sign.

What we do not claim

We are not a HIPAA-certified vendor. We build and operate HIPAA-appropriate infrastructure for engagements that require it. Your legal team reviews the BAA. We deliver what the BAA covers.

Who this is for

Healthcare practices, healthcare platforms, and any business that handles PHI and needs their AI deployment to match their compliance posture.

What you can ask for

Documents we will sign.

Standard mutual NDA available before the first scoping call. BAA available where the engagement requires it. Security overview deck on request.

  • Mutual NDA

    Available before scoping. Standard form on request.

  • BAA (HIPAA)

    Available for engagements that require it. Signed before any PHI touches the system.

  • DPA

    Available for clients with EU data subjects.

  • Security overview

    PDF, written for an IT lead. Available on request. No marketing follow-up.

Note: SOC 2 and ISO certifications are not on the roadmap for 2026. We are honest about that. We lead with architecture and contracts, not badges we have not earned.

Enterprise and regulated buyers

Ready to talk through your environment?

Book a call and we walk your IT lead through the architecture in 30 minutes. Or email us and we send the security overview PDF the same day.

Book a security callEmail security@salvus-ai.com