Trust Center.
Security & compliance.
SOC 2 (Security and Confidentiality criteria) — controls mapped and evidence collected in-product; not yet audited. ISO 27001 — not yet certified. GDPR-aligned; independent assessment not yet completed. No third-party penetration test has been performed yet; when one is, its date will be published here. Uploaded documents, exports and backups are stored in AWS ap-south-1 (Mumbai, India) with server-side encryption at rest (AES-256); all traffic is encrypted in transit with TLS 1.2 or later. India holds no EU or UK adequacy decision — the transfer terms are in the DPA. An air-gapped deployment mode disables every external model vendor and all telemetry. Inside the product, your administrators set access policies (IP allowlist, allowed platforms, session age) and AI administration (model ceiling, feature switches, a daily AI-spend cap); changes are written to an append-only audit trail; identity documents never reach an AI vendor; and exported files carry machine-readable AI-provenance metadata. Multi-factor authentication is not enforced today. Details on the security page.
- Live system status → API and database, polled in real time
- Data Processing Agreement → including the current sub-processor list
- Sub-processor register (machine-readable) → generated from the running configuration
- Privacy policy → what we collect, and how long we keep it
- Security practices →
- Report a vulnerability → security.txt