Section 00
SECURITY
The foundation
everything else stands on
Built for the rooms where the answer has to hold up.
The controls, the oversight and what we do not hold yet, each stated exactly.
Section 01
SECURITY FEATURES
Six controls. Every layer covered.
Encryption
All data is encrypted at rest (AES-256) and in transit (TLS 1.3).
Infrastructure
Hosted with a SOC 2 attested cloud provider, with redundancy.
Access Control
Role-based access control with multi-factor authentication.
Audit Logging
Comprehensive audit trails for every user action and data access.
Single sign-on
SAML 2.0 single sign-on on Enterprise plans, configured by your own org admin.
Vulnerability Management
Continuous monitoring with scheduled vulnerability assessments.
Section 02
COMPLIANCE
What we can show today, and what we do not claim.
Last reviewed 28 October 2026
- Hosting
- A SOC 2 attested cloud provider. The attestation is the provider's, not ours.
- Model training
- Your data never trains a model.
- Certifications
- None held yet. We claim no SOC 2, ISO 27001, GDPR or CCPA certification of our own until an auditor confirms it.
Section 03
OVERSIGHT
What your admins can see, and what the model runs on.
- Answer feedback
- Every answer takes a rating and a comment from the reader, kept with the answer.
- Citation registry
- Every answered query is recorded with the sources that grounded it, in the Trust Center.
- Flagged claims
- A claim the verifier could not ground is listed with its verdict, never counted as verified.
- Audit log
- Every user action and data access, viewable by org admins and exportable.
- Single sign-on
- SAML 2.0, on Enterprise plans.
- Model providers
- OpenAI runs the hosted service. Anthropic, Cohere, Azure OpenAI and Mistral are wired through the same routing layer and run for a tenant set up with its own key. Self-hosted models are not built.
- Connectors
- Uploads on every plan. Google Drive from Starter, S3 and Google Drive on Pro, SharePoint and Confluence on Enterprise.
Section 04
DATA RESIDENCY · ROADMAP
INCIDENT RESPONSE
Your data, where your regulator says it has to live.
Region-pinned storage for Enterprise customers, so data stays in the jurisdiction the regulator names, is on the roadmap and not yet shipped. Until it is, ask where your data is hosted before you sign and we will answer in writing.
24/7 monitoring. 72‑hour notification.
We maintain a comprehensive incident response plan with continuous monitoring; what the monitoring sees is published on the status page. In the event of a security incident, affected customers will be notified within 72 hours as required by GDPR and other applicable regulations.
Section 05
INQUIRIES
Questionnaires, pen-test reports, vulnerability disclosure: one request, one address.
Documentation requests
Security questionnaires, penetration test reports, SOC 2 documentation, and other security artifacts, requested through the form. We reply within 24 hours.
Request the security documentationResponsible disclosure
Report a security vulnerability with details. We acknowledge receipt within 24 hours and appreciate responsible disclosure.
[email protected]Next step
Ask us the questions your reviewer will ask.
Bring the questionnaire, the pen-test question and the data-residency question. We answer each one in writing, on the record, before you sign.