ISO/IEC 27001
A structured approach to information security management, supporting clear responsibilities, risk assessment and ongoing improvement.
Security & Compliance
A layered approach to information security, AI risk management and regulatory accountability, designed for enterprise due diligence.
Management system certifications
Build confidence in your AI adoption with ISO/IEC 27001 and ISO/IEC 42001 management system certifications, verified by accredited independent auditors. Contact our team to review the certification scope.
ISO/IEC 42001
A management framework for responsible AI adoption, including AI risk governance and model lifecycle management.
Security by architecture
Layered controls support regulated and data-sensitive workflows.
Private boundaries
Air-gapped infrastructure, on-premises data residency and zero-trust architecture.
Identity and evidence
Granular access control, immutable audit trail and hard source grounding.
AI protection
PII masking and tokenisation, prompt-injection protection and data-leakage prevention.
Review alignment
Controls mapped to OWASP Top 10 for LLM risks; validation and human review remain part of operation.
Accountability within automated decisions
HKMA High-Level Principles (2019) and MAS FEAT converge on accountability: the board owns every automated decision. Controls must make that ownership operational and audit-ready.
Regulatory control mapping
Alignment describes how our controls map to these frameworks; it is not regulatory endorsement. References should be validated against current guidance during each project.
| Area | HKMA & local frameworks | MAS & local frameworks | How Metis addresses it |
|---|---|---|---|
| AI governance | HKMA High-Level Principles on AI | MAS FEAT | Governance framework · Decision traceability |
| AI accountability | Management responsibility | AI lifecycle governance | Audit trail · Human-in-the-loop |
| Data privacy | PCPD / DPO ethical AI framework | PDPA | PII masking · Tokenisation · Data residency |
| Generative AI | DPO GenAI guideline / SFC GenAI circular | IMDA Generative AI Framework | AI firewall · Model governance |
| Agentic AI | Applicable HKMA AI and technology-risk guidance | IMDA Agentic AI Framework | Deterministic rules engine |
| Technology risk | HKMA SA-2 / SPM TM-G-1 | MAS Outsourcing Guidelines | Air-gapped deployment · Vendor governance |
| AI security | OWASP Top 10 for LLM | AI risk and security controls | Prompt-injection protection · Leakage prevention |
| Information security | ISO/IEC 27001 | ISO/IEC 27001 | ISMS · Access and audit controls |
| AI management system | ISO/IEC 42001 | ISO/IEC 42001 | AI risk governance · Model lifecycle |
| Third-party governance | Outsourcing due diligence | Outsourcing due diligence | Vendor transparency · Audit rights |
Security reviews without source disclosure
Compiled builds and independent third-party assessments support bank security reviews while protecting source code.
Metis at a glance
ARX is the private AI core. AERIX extends it with policy-governed access to approved cloud AI. Sensitive workflows retain source citations, human approval and audit visibility.
- Platform
- Metis ARX · Metis AERIX
- Category
- Private and governed hybrid enterprise AI
- Deployment
- On-premises, air-gapped, private cloud; hybrid extension through AERIX
- Document languages
- DeepSight™: English, Traditional Chinese and Simplified Chinese
- Industries
- Banking, Healthcare, Utilities, Logistics, Retail, Building & Construction, Education
- Sales contact
- enquiry@metis.info
Define your next step with Metis.
Discuss your operational priorities, deployment requirements and evaluation criteria with our team.
