Trust at every layer.
Control at every step.
Top Bucket AI runs as single-tenant infrastructure inside an isolated Amazon Web Services VPC, with customer-managed encryption, private model inference, and attribute-based controls on every retrieval. Security is engineered into how the work executes.
Discuss your requirementsAn isolated environment.
On AWS, end to end.
Each client environment is provisioned from version-controlled infrastructure-as-code into its own AWS VPC. Your data never shares a runtime, a database, or an encryption key with another firm.
How traffic arrives
AWS WAF & Shield
Managed rules, rate limiting, DDoS mitigation
TLS 1.3 termination
ACM-managed certificates, HSTS enforced
AWS PrivateLink
Optional private path from your VPC
Where agents execute
Dedicated VPC
Single-tenant, three Availability Zones
Private subnets
Containerized runtimes, no public IPs
Ephemeral sandboxes
Isolated, short-lived tool execution
Where inference happens
Amazon Bedrock
Invoked over a VPC interface endpoint
Model gateway
Routing, token budgets, schema validation
Guardrails
Injection screening and PII redaction
Where evidence lives
Amazon S3 + KMS
Customer-managed keys, VPC-only access
Aurora PostgreSQL
Relational and vector stores with ACL metadata
Secrets Manager
Rotated credentials, none in code or images
How it is watched
CloudTrail & CloudWatch
Control-plane and runtime telemetry
S3 Object Lock
Write-once retention of audit events
GuardDuty & Security Hub
Threat detection and posture checks
From identity
to an approved outcome.
Trace a single agent request through the network edge, identity and entitlement checks, permissioned retrieval, the model gateway, and human review.
Private network edge
Requests terminate TLS 1.3 at a load balancer behind AWS WAF and Shield, or arrive privately over AWS PrivateLink from your own VPC. Agent runtimes and data stores sit in private subnets with no public IP addresses.
Example: a firm connected over PrivateLink reaches the platform without any traffic crossing the public internet.
Every control
has a reason to exist.
The risks that matter to a credit fund, from MNPI leakage and cross-fund contamination to model training on proprietary data and prompt injection, and the specific mechanisms that address each one.
Network isolation
Why it matters
Data rooms, borrower financials, and MNPI are among the most sensitive information a firm holds. Shared multi-tenant runtimes and public network paths widen the blast radius of any single failure.
How it’s enforced
- A dedicated Amazon VPC per client, provisioned from version-controlled Terraform across three Availability Zones.
- Agent runtimes, databases, and vector indexes sit in private subnets with no public IP addresses and no inbound internet route.
- VPC endpoints for S3, KMS, Secrets Manager, and Amazon Bedrock keep service traffic on the AWS network rather than the public internet.
- Security groups are scoped service to service; outbound egress is restricted to an explicit allow-list.
- Optional AWS PrivateLink or Site-to-Site VPN from your network, or deployment into an AWS account your firm owns.
Encryption & key custody
Why it matters
Encryption is only as strong as control over the keys. Auditors and LPs increasingly ask who can decrypt the data, and how quickly that access can be revoked.
How it’s enforced
- AES-256 encryption at rest for S3, Aurora, EBS volumes, and backups through AWS KMS customer-managed keys.
- Keys can reside in your own AWS account and be granted to the environment. Revoking the grant renders the data unreadable.
- TLS 1.2 or higher for all traffic in transit and TLS 1.3 at the edge, with certificates managed by AWS Certificate Manager.
- Automatic key rotation, with every key use recorded in AWS CloudTrail.
Model data boundary
Why it matters
The first question from every investment committee: will our proprietary data train someone else’s model, or leave our environment during inference?
How it’s enforced
- Inference runs on Amazon Bedrock in your selected AWS Region, invoked privately over a VPC interface endpoint.
- Under Bedrock’s service terms, prompts and completions are not used to train foundation models or shared with model providers.
- Model invocation logging is off by default, or written only to an encrypted bucket you control.
- No calls to public third-party model APIs unless a provider is explicitly approved for a workflow, under zero-data-retention terms.
Identity & information barriers
Why it matters
Credit firms maintain information barriers between funds, deals, and public-side and private-side teams. An AI system with unrestricted visibility quietly dissolves those walls.
How it’s enforced
- Single sign-on through your identity provider, such as Okta or Microsoft Entra ID, over SAML 2.0 or OIDC, with MFA enforced upstream.
- SCIM provisioning, so access ends the moment your identity provider deprovisions a user.
- Attribute-based access control: every indexed passage inherits fund, deal, and wall-crossing attributes from its source system.
- Entitlements are applied as a pre-filter before vector search, so restricted text never enters a model’s context window.
- Service identities use least-privilege IAM roles with short-lived STS credentials. There are no long-lived access keys.
Agent containment
Why it matters
Agents that can take actions are a new attack surface. A hostile instruction hidden in a data-room PDF, a prompt injection, must never be able to trigger an action.
How it’s enforced
- Retrieved document content is treated as untrusted data and kept structurally separate from system instructions.
- Per-agent tool allow-lists. Tools are read-only by default and scoped to the entitlements of the task.
- Outbound email, system-of-record writes, and other consequential actions require a human approval bound to the exact payload.
- Code and file transformations run in ephemeral, network-restricted containers that are destroyed after each task.
- Token budgets, step limits, and rate limits bound every run.
Audit & traceability
Why it matters
Examiners, LPs, and your own investment committee may need to reconstruct exactly how a conclusion was reached, months after the fact.
How it’s enforced
- Every retrieval, model invocation, tool call, handoff, edit, and approval is emitted as a structured event with an OpenTelemetry trace ID.
- Audit events are written to Amazon S3 with Object Lock in compliance mode, immutable for the retention period you set.
- Retention can be aligned to your books-and-records obligations, such as Advisers Act Rule 204-2.
- AWS CloudTrail captures control-plane activity, and events can stream to your SIEM, such as Splunk or Datadog.
Threat detection & resilience
Why it matters
Surveillance and reporting workflows run on deadlines. The environment must detect threats early and recover without losing work.
How it’s enforced
- Amazon GuardDuty threat detection and AWS Security Hub posture checks against the CIS AWS Foundations Benchmark.
- AWS WAF managed rule sets and AWS Shield protection at the edge.
- Multi-AZ databases with automated backups and point-in-time recovery.
- Immutable infrastructure: environments are rebuilt from reviewed Terraform, never modified by hand.
Residency & data lifecycle
Why it matters
Data should live where your regulatory obligations require, and only for as long as it is needed.
How it’s enforced
- Each environment is pinned to a single AWS Region you select, such as US East or Europe (London).
- Retention policies are defined per data class and enforced through S3 lifecycle rules.
- On termination, data is deleted and the associated KMS keys are scheduled for destruction, leaving any residual copies unreadable.
This page describes Top Bucket AI’s standard deployment architecture. The AWS account model, Region, approved model providers, certifications, and service levels for your firm are confirmed in the applicable security documentation and agreement.
Details worth
getting right.
No. Inference runs on Amazon Bedrock and is reached through a VPC interface endpoint, so traffic stays on the AWS network. Under Bedrock’s service terms, prompts and completions are not used to train foundation models or shared with model providers. If another provider is approved for a specific workflow, it is used only under zero-data-retention terms confirmed in your agreement.
Yes, as a deployment option. The same Terraform modules can provision the environment into an AWS account your firm owns, so the VPC, KMS keys, logs, and backups sit under your organization’s service control policies and billing. The alternative is a dedicated, single-tenant account operated on your behalf. The account model is agreed during scoping.
Every indexed passage carries fund, deal, and wall-crossing attributes inherited from its source system. The retrieval layer applies them as a pre-filter before similarity search, so restricted content never enters a model’s context window. The same policy is re-evaluated at every agent-to-agent handoff.
Document content is treated as untrusted data and isolated from system instructions. Agents run with allow-listed, read-only tools by default, egress from the agent tier is restricted to known endpoints, and any write or outbound action requires a human approval bound to the exact payload.
No. External communications sit behind human approval. The capability to draft a letter is separate from the authority to send it: a reviewer must approve the final content and the distribution list.
Yes. Request a security review through the demo form. We can walk your team through the architecture, the infrastructure-as-code control definitions, data-processing terms, and the assessment documentation available during diligence.
Extraordinary work.
Collective intelligence.
See what an orchestrated agent team can do inside your investment process.