Keeping Owkin secure

After a decade of working with pharmaceutical clients, we’ve learned at Owkin that security is the foundation of trust. If you want to work with client systems containing priceless proprietary patient data, then you need to be a safe pair of hands. Our partners know we can be trusted with their data, because we retain the highest levels of security. Here’s how we manage it.

Owkin has maintained continuous compliance with ISO 27001 for many years, the internationally recognised standard for Information Security Management. Owkin commits to actively maintaining this standard, which is validated by independent audit and renewed each cycle.

For the past consecutive audit cycles, Owkin has achieved 100% audit attestation, a rare benchmark demonstrating total alignment between our documented policies, operational controls, risk management processes, and live infrastructure.

Owkin has recently achieved official membership in the Cloud Security Alliance (CSA) and attained STAR Level 1 certification which is a recognised benchmark for cloud security transparency and trust in the industry.

This milestone reflects our ongoing commitment to the highest standards of data security, AI safety, and compliance,values that sit at the core of everything we build. Our CSA STAR Registry listing is publicly accessible, offering clients and partners direct visibility into our certified security posture: cloudsecurityalliance.org/star/registry/owkin-inc‍

What's Next: CSA Board Seat

Active discussions are underway to secure a board seat within the Cloud Security Alliance. This will further cement Owkin's role in shaping the future of AI security standards across the industry.

Security in K Pro is a core product feature. At Owkin, our CISO function operates at the intersection of AI, engineering, clinical research, and regulatory compliance. We don't simply respond to threats; we architect systems that make breaches structurally improbable.

Our Security Philosophy

We apply three guiding principles across every system we build and every decision we make:

• Resilience — we design systems as if every perimeter will eventually be tested. Segmentation, least-privilege access, and zero-trust principles mean that a compromised component cannot cascade.
• Shift Left — security review is embedded at the earliest stages of engineering using automated scanning, threat modelling, and secure-by-default frameworks.
• Transparency by Design — our live Trust Centre replaces static documentation with real-time control status, certifications, and policy visibility.

Engineering Excellence Underpins Security Excellence

The strength of our security posture is inseparable from the quality of our engineering culture. We invest heavily in:

• Continuous threat intelligence and red team exercises that pressure-test our defences against evolving attack vectors.
• Automated compliance pipelines that monitor control drift in real time, ensuring our ISO 27001 posture is always audit-ready.
• Supply chain security practices that extend our standards to every dependency, integration, and third-party vendor we engage.
• AI-specific security controls addressing the novel threat surface introduced by large-scale model training and LLM and agent workflows.

Looking Forward

The threat landscape for AI is evolving rapidly,and so are we. Our security roadmap is a living document, continuously updated in response to emerging attack patterns, regulatory developments, and the growing complexity of our product ecosystem. We are committed to remaining at the frontier, not just in the science of AI-driven medicine, but in the security and trust infrastructure that makes it possible.

Live Trust Center

Owkin's Trust Center provides real-time visibility into our security control status, active certifications, and compliance posture. It is available to partners, clients, and stakeholders as a central hub for security transparency.