You trust us with your security posture. Here’s how we keep it.
You upload security policies, audit reports and past answers. This is a summary of how they’re protected; the full statement is kept in the app.
Your data never trains AI models
Your documents, questions and answers are processed only to produce your answers, under terms that prohibit using them for training, by us or anyone else.
Your data stays in your organization
Every record belongs to one organization, and the database itself refuses access across organizations. An automated isolation test runs on every database change.
Answers you can verify
Every drafted answer cites the passages it came from. Unsupported questions are flagged as Needs input instead of guessed, and expired documents are never used.
You stay in control
Only answers a person approved go into what you send. Deleting a document deletes its file, its text and its search data.
Encryption and storage
- TLS for all traffic; AES-256 encryption at rest
- Private file storage, served only through short-lived signed links
- Integration tokens additionally encrypted, readable only by background jobs
Access and audit
- Four roles, enforced by the database
- SAML single sign-on or two-factor sign-in, which organizations can require
- Verified email before use, breached-password checks and a bot check on sign-up
- Sessions that expire, a list of signed-in devices, and alerts for new sign-ins
- An audit log of approvals, exports, downloads, deletions and settings
Data handling
- No document contents or full prompts in production logs
- Error reports scrubbed of emails, tokens and request data before they’re sent
- Organization deletion after a 7-day grace period removes every record and file, and any error reports expire within 90 days
- Hosting in another region, or a dedicated database, on request
Compliance, honestly stated
We’re preparing for a SOC 2 Type I audit, followed by Type II, with our controls mapped to the SOC 2 criteria. We don’t claim a certification we don’t hold. For questionnaires about us, or to report a vulnerability, write to security@example.com.
Your next questionnaire, answered by Friday.
The Free plan includes 150 drafted questions and unlimited members. No credit card.