A posture is how hardened your deployment is. It is not a product edition, and nothing is withheld to sell you the next one.
Three named postures, additive, each a set of controls rather than a set of features. The same product is deployed at all three. What changes is the network path, the key custody, the audit trail, the identity requirements and where inference may run. This page gives you the whole matrix, what each posture adds to your cloud bill, and who belongs on which.
The word "tier" is overloaded in this industry, so be clear what it means here. A posture is a security configuration: which controls are switched on in the infrastructure that gets deployed into your account. It is not a commercial edition. There is no feature held back at Baseline to make Standard attractive, and the governance controls that matter most, the four denies on every inference call, are identical at all three.
Rows are controls, columns are the three postures. Read the Baseline column carefully: it is the column most vendor comparison tables would quietly leave out.
| Control | Baseline | Standard | Strict |
|---|---|---|---|
| Single-account isolation: one organization, one account you own | ✓Yes | ✓Yes | ✓Yes |
| Encryption in transit and at rest | ✓Yes | ✓Yes | ✓Yes |
| Encryption keys | △Provider-owned | △Provider-managed | ✓Customer-managed, rotation on |
| Content policy mandatory on every inference, enforced as a deny | ✓Yes | ✓Yes | ✓Yes |
| Governed route, endpoint region and retention denies | ✓Yes | ✓Yes | ✓Yes |
| Least-privilege identity policy, everything as code | ✓Yes | ✓Yes | ✓Yes |
| Model invocation logging: model, caller, latency, tokens. No prompt or answer text | ✓Yes | ✓Yes | ✓Yes |
| Private network endpoint to the model service | ✕No | ✓Yes | ✓Yes |
| Network-attached chat compute | ✕No | ✓Yes | ✓Yes |
| Account-level audit logging: multi-region, file validation, one-year retention | ✕No | ✓Yes | ✓Yes |
| MFA enforced | ✕No, can be added | ✓Yes | ✓Yes |
| Our management access into your account | ✓None exists | △Scoped, session-capped | △Scoped, session-capped |
| Inference residency | ✕Global routing | ✕Global routing | ✓Pinned to your jurisdiction |
| Storage region | ✓Chosen per deployment | ✓Chosen per deployment | ✓Chosen per deployment |
Two rows are judgments rather than measurements. "None exists" at Baseline means no cross-account role for us is created at all, which is stricter than the columns to its right and slower when you want help. And the residency row costs capability rather than money: see data residency for the model list a pin leaves you.
Baseline has no private networking and no account-level audit trail. Traffic to the model service is signed and encrypted from inside the cloud, which is a defensible position, but it is not private networking and we will not call it that. A formal security review will usually want Standard.
In plain words, without the euphemisms. The right posture is usually obvious once someone says out loud what the deployment will actually hold.
Low-sensitivity material, an internal pilot, a team finding out whether governed AI is worth the effort. Cheap to run and genuinely governed on the controls that matter most. Not the posture to put a regulated corpus on, and not the posture to take into a customer's vendor review. If you are here to prove value first, start here and move up.
You have customer security reviews, an internal control framework, or an auditor who will ask for an audit trail and key management. This is the posture we recommend by default, and the one we would bring to a reviewer. Private network endpoint, account audit trail with a year of retention, managed keys, MFA enforced, and our access scoped and session-capped.
A jurisdictional obligation you cannot meet with disclosure, or a formal evidence pack that requires customer-managed keys with rotation. Everything Standard has, plus key custody and the inference pin. Go in knowing the pin's price in models, decide per workload, and read data residency before committing.
Not on our invoice. Our fees are the ladder on pricing and they do not change with posture. What changes is the infrastructure running in your own account, billed to you by your provider at list price. These are figures we have seen, not a quote.
Infrastructure figures exclude inference. The all-in range is one deployment with light usage, in Canadian dollars, and yours will differ with how much people use it. Inference is the variable part: a knowledge question of roughly 10,000 tokens in and 1,000 out costs an estimated 4 to 5 cents at a mid-tier frontier model's list price. Worked through on compute costs.
Moving from Baseline to Standard costs on the order of a hundred dollars a month on your cloud bill. If a hundred dollars a month is what stands between you and a security review that passes, take the hundred dollars.
The posture is chosen during discovery by walking the security posture questionnaire, which we publish so that you see the questions before the call rather than after the contract.
The three postures are deliberately coarse. Per-control overrides exist and each carries a written reason, and the combinations exercised end to end are the three named ones, so if you need an unusual mix, say so in discovery and we will tell you what it has been tested against.
For low-sensitivity material and a first evaluation, yes: account isolation, encryption in transit and at rest, the mandatory content policy and the other three denies, least-privilege identity policy and everything as code. For a formal security review, usually not, because there is no private network path and no account-level audit trail. Baseline suits low-sensitivity use and a first evaluation, and that is how we sell it.
Technically yes, as a per-control override with a written reason, and it will show on your plan page as a non-standard configuration. Ask for it in discovery and we will test that combination on your deployment before you depend on it.
Nobody inside the running system. Administrators manage users, roles, grants, quotas and module channels; they cannot change the posture, residency, the model allowlist, the content policy or admit a module. Those are deploy-time parameters, changed through a release with your agreement. See administration.
Only at Strict, and only through residency: the pin limits which models can serve a request, which is a real change to what the chat can do. Baseline and Standard run the same catalogue. Everything else a posture changes is beneath the application: network path, keys, audit trail, MFA and our access.
It does not. There are no product tiers. The commercial ladder is one assessment, one deployment engagement, one monthly managed-operations fee and compute billed directly to you, and it is identical at all three postures. The word tier on this page means security posture only.
Ask in discovery. Some things exist and are switched on where a deployment needs them, such as evidentiary storage with object lock, a seven-year default retention and break-glass access requiring MFA. Some things do not exist, and on those we will say no rather than write a roadmap item into a contract. The list of what we do not claim is published.
Every question we will ask in discovery, including the one about attestation that most vendors would rather you did not think about.
The controls matrix, mapped to SOC 2 Trust Services Criteria and ISO/IEC 27001:2022 Annex A, with an honest verdict on each row.
The same argument from the seat of the reviewer who has to say yes, and answer for it afterwards.
Bring the control framework you are held to, and we will tell you which posture meets it and what that costs on your own cloud bill.