Security
Information security and the protection of sensitive data are an absolute priority for us in the CODEXIS application.
Information security and the protection of sensitive data are an absolute priority for us in the CODEXIS application. We use a solution provided by OpenAI, which is designed with an emphasis on a high degree of data confidentiality, integrity, and availability. This means that CODEXIS delivers not only powerful language models but also a robust security framework that meets the demands of a corporate environment.
Key security principles
- Data sent from CODEXIS to the OpenAI API is not used to train or improve the models. No additional learning takes place; your interactions remain confidential and isolated.
- Zero data retention for OpenAI models. We have a contractual Zero Data Retention agreement with OpenAI: neither API requests nor responses are stored (zero retention).
- Optional EU data residency for OpenAI models. By default, AI queries are processed by OpenAI in the USA (transfer under SCC); for OpenAI models, you can optionally enable processing within the EU in the settings ("Data processing"); requests and responses then never leave the European Union.
- Encryption and access control.
- Communication between users and the application is secured using modern encryption protocols. System access is governed by user permissions and audit logs, which allows precise control over who accessed the data and when.
- In the chat history, we offer the option to delete a chat.
- Compliance with legislation (GDPR and others) - we are an ISO-certified company.
AI Act compliance
CODEXIS AI is a downstream AI system under Regulation (EU) 2024/1689 of the European Parliament and of the Council (the AI Act). ATLAS consulting is its provider; the general-purpose models come from OpenAI, Anthropic and Google, who meet their own obligations under the AI Act. We take the AI Act requirements that apply to the product's role and functions into account in both development and operation.
You can recognise the AI functions in the product as tools that use artificial intelligence. Their output is supporting material, it may contain inaccuracies and it requires expert review. The product does not replace legal judgement or human decision-making.
As the deployer you are responsible for the lawfulness of your particular use, for your own internal rules and for the AI literacy of your staff under Article 4 of the AI Act.
The document Information on the use of AI and AI Act compliance covers the details. It is not an unqualified guarantee that every possible use complies; that always has to be assessed against the actual function and intended purpose.