generated: '2026-08-02'
method: searched
probe: true
url: null
note: 'Aleph Alpha publishes no trust-center portal. trust.aleph-alpha.com and security.aleph-alpha.com
  do not resolve, and /security, /trust and /compliance on aleph-alpha.com return 404 (probed
  2026-08-02). Its published compliance posture lives in two places instead: an independently
  listed ISO/IEC 27001:2022 certificate, and a supply-chain security disclosure page in the
  installation guide.'
certifications:
- standard: ISO/IEC 27001:2022
  holder: Aleph Alpha GmbH
  scope: 'Research, development and commercialization of generative AI technology with focus on multimodal large language models'
  certificate_number: '31625355'
  certifier: DQS
  source: https://www.dqsglobal.com/en/customer-database/aleph-alpha-gmbh
supply_chain_security:
  url: https://docs.aleph-alpha.com/phariaai-install-config-guide/latest/installation/before-you-start/security-disclosure-v2.html
  practices:
  - 'Every PhariaAI container image cryptographically signed with Cosign keyless signing (GitHub Actions OIDC), bound to the exact image digest.'
  - 'SLSA provenance verifiable with --verify.'
  - 'CycloneDX SBOM attestation per image.'
  - 'SPDX package and license metadata for compliance workflows.'
  - 'Trivy build-time CVE findings published as a signed JSON attestation.'
  - 'Verification scripts published at https://github.com/Aleph-Alpha/support (cosign-verify-image.sh, cosign-extract.sh).'
  legacy: https://docs.aleph-alpha.com/phariaai-install-config-guide/latest/installation/before-you-start/security-disclosure-v1.html
  purpose: 'Explicitly framed for archiving audit evidence for ISO 27001, SOC 2 and AIC4.'
hosting_certifications:
- standard: BSI C5, ISO 27001
  holder: STACKIT GmbH (hosting provider for Pharia Government Assistant, Germany)
  source: https://docs.aleph-alpha.com/verticals/pga-de/uebersicht.html
  note: 'Provider-of-provider certification, not Aleph Alpha''s own.'
evidence:
- {source: 'https://www.dqsglobal.com/en/customer-database/aleph-alpha-gmbh', kind: third-party-certificate-registry, keywords: ['ISO IEC 27001:2022']}
- {source: 'https://docs.aleph-alpha.com/phariaai-install-config-guide/latest/installation/before-you-start/security-disclosure-v2.html', kind: docs, keywords: ['SBOM', 'SLSA', 'Cosign', 'ISO 27001', 'SOC 2', 'AIC4']}
probes:
- {url: 'https://trust.aleph-alpha.com/', result: 'DNS does not resolve'}
- {url: 'https://aleph-alpha.com/security/', http_status: 404}