Security
What we do to protect your data, what we don't claim, and who else can touch it. Every customer can generate a dated, per-company version of this — an evidence pack — from inside the product.
Controls
- Tenant isolation, enforced in the ORM
- Not per-query discipline: every tenant-scoped model reads through a manager bound to the request's company, and the single cross-tenant escape hatch is greppable and used only by platform-operations sweeps.
- Credentials encrypted at rest, under separate keys
- Provider keys and (where enabled) captured conversation content use distinct AES-256 keys held outside the database, so exposure of one never exposes the other.
- Policy enforced in the request path
- PII redaction, prompt-injection scanning, model allowlists and spend caps run before a prompt leaves your network — not as an after-the-fact report on traffic that already left.
- Immediate revocation
- Disabling a tenant's governance app deactivates its proxy tenant immediately; deactivating an employee revokes that person's proxy keys. Neither waits for a cache to expire.
- Append-only audit trail
- Governance decisions and administrative changes are recorded on the action itself, independently of whether any notification succeeded. If the notify channel is down, the event still happened and the audit row is the record.
- Restricted egress on customer-supplied endpoints
- A customer-configured upstream URL is HTTPS on port 443 only, and is rejected if it resolves into a loopback, private, CGNAT, link-local or cloud-metadata range — re-checked at connection time, so a hostname that changes its answer cannot reach internal infrastructure.
- Honest provenance on every cost figure
- Measured, reconciled and declared spend are labelled and never summed into one number. Spend the platform cannot see is reported as unavailable, never as zero.
What we don't have
Stated plainly, and given the same weight as the section above. An implied certification is found during diligence, and costs more than saying so here would have.
- SOC 2 Type II
- Not held. The controls above are implemented and evidenced, but have not been audited by a third party.
- ISO 27001
- Not held.
- Third-party penetration test
- None commissioned to date.
Subprocessors
Every third party that can touch customer data. Entries marked conditional apply only if you have enabled the capability that uses them — if you have never configured an OpenAI credential, you have no OpenAI subprocessor relationship, and your evidence pack will say so.
| Subprocessor | Purpose | Data |
|---|---|---|
| Amazon Web Services | Application hosting, managed Postgres, object storage. | All customer data at rest and in transit through the platform. |
| Stripe | Payments for subscriptions and balance top-ups. | Billing contact details and payment tokens. No AI prompt or response content. |
| Anthropicconditional | Model inference. | Prompt and response content for requests routed to Anthropic models. |
| OpenAIconditional | Model inference. | Prompt and response content for requests routed to OpenAI models. |
| Google (Gemini API)conditional | Model inference. | Prompt and response content for requests routed to Gemini models. |
| Connected business systemsconditional | Reading records you have explicitly connected and granted an app access to. | Whatever your own connected system holds. We store the connection, never a mirror of the records. |
Data Processing Agreement
A DPA template is available on request and is referenced by every evidence pack. It covers roles, retention, subprocessor notice, and — explicitly — what we don't hold, since that changes what we can help with on a data subject request.
Reporting a vulnerability
Security reports are welcome and are not treated as a support ticket. Include reproduction steps and the affected endpoint where relevant.