How we handle your data
Because this is fitted software sitting on your data, most of our security story is about keeping that data where it already is — with you.
Your data, your region
We can run the product on your cloud account and region when that’s the requirement. Data doesn’t have to leave your control for us to work.
Encryption
Data in transit is protected with modern TLS. Data at rest is encrypted with industry-standard ciphers. Where we host components for you, backups are encrypted too.
Access control & audit
Role-based permissions with least-privilege defaults, and an audit trail covering configuration changes and every action the AI layer takes. Sensitive actions can require human approval before they run.
Data use & retention
Your content is used for retrieval and to run the service — not to train third-party models. We configure providers to exclude your data from training where that option exists, and retention windows are set to your policy.
Guardrails, agreed up front
Before anything ships we agree the boundaries with your team: what the AI can answer, what it must confirm, and what it must never attempt. There is always an off switch you control.
Disclosure & incident response
We have defined procedures for detecting, responding to, and communicating security incidents. Responsible disclosure is welcome through our bug bounty program.
Security researchers can review our bug bounty program and hall of fame. For data handling, see our privacy policy.
