Security isn't a once-a-year stamp here — isolation runs at the database, encryption is end-to-end, and the controls are checked continuously. Here's exactly how.
Postgres Row-Level Security enforces tenant separation at the data layer, not just in app code. A bug in code can't leak across tenants.
AES-256-GCM at rest. TLS 1.3 in transit. User IDs are HMAC-fingerprinted, never stored raw alongside conversation data.
Every AI action, every approval, every signal is traced. The full audit log is exportable for security reviews on Business and above.
One-click deletion cascades through derived data, embeddings and KB entries — built to satisfy GDPR and CCPA erasure requests. A DPA is in place before contract.
Tenant isolation goes all the way down — model calibration, embeddings, save-offer history and draft-acceptance signals all stay scoped to your workspace.
Agent-driven control checks run 24/7 across data handling, access and DPA terms — not a once-a-year stamp.
Continuous controls monitoring GDPR-aligned CCPA-aligned HIPAA-ready
A deletion request cascades through the derived layers — embeddings, KB entries, model signals — not just the primary record. Gone means gone.
A Data Processing Addendum is signed before any customer data flows. Every material sub-processor is bound by contract to the same standard.
Calibration and embeddings stay scoped to your workspace. Our LLM and embedding sub-processors are contractually prohibited from training on your data.
We hold ourselves to recognized frameworks and tell you exactly where each one stands — no overclaiming.
We're working toward SOC 2 Type II. It is not yet certified, and we won't claim it until it is. Ask us for the current status and we'll tell you where the audit stands.
GDPR-aligned, CCPA-aligned and HIPAA-ready controls are checked continuously by agent-driven monitoring, with the evidence available for your review.
Running a procurement or security review? Email us — a human answers, and we'll share what we can support today rather than what sounds good.
Consolidating five or six tools into one means one vendor to vet — and procurement actually likes you.