Security

Enterprise-grade by design.

Built to pass your security review, not just your demo. Six controls every enterprise security team asks about, and how we answer.

Never used for training

Your data is never used to train or fine-tune models, ours or any provider's.

Deploy where you want

Your VPC, on-premises, or our cloud, with regional data residency.

Human in the loop

Any action that changes a system of record can require approval.

How we protect your data

Sanctioned sources only

Connectors read exclusively from admin-approved systems. Allow-listed sources, scoped connectors, no shadow data. Nothing is ingested that IT hasn't sanctioned.

Your ACLs, respected

Permission-aware retrieval mirrors source-system access (SharePoint, Drive, CRM, ERP). Users only see what they're already entitled to, down to row and field level.

OAuth 2.0 · SSO · least privilege

OAuth 2.0 / OIDC and SAML SSO with your IdP; SCIM provisioning; role-based access; short-lived, revocable tokens. We never store your users' passwords.

Encrypted end-to-end

TLS 1.2+ in transit, AES-256 at rest, secrets in a managed vault. Bring your own keys (KMS / HSM) so you hold the master key, not us.

Isolation & residency

Strict tenant isolation, sandboxed processing, private endpoints to model providers. Data stays in the region you choose; retention and purge on your schedule.

Audit, monitoring & compliance

Immutable audit logs of every access and action, exportable to your SIEM. PII detection & redaction. Controls aligned to SOC 2, ISO 27001, GDPR and India's DPDP Act.

AI-specific safeguards

Injection & exfiltration guardrails
Grounded, cited answers
Private model endpoints
Answer-to-source lineage