Trust Center.
Security & compliance.
SOC 2 (Security and Confidentiality criteria) — controls mapped and evidence collected in-product; not yet audited. ISO 27001 — not yet certified. DPDP Act 2023 aligned; independent assessment not yet completed. No third-party penetration test has been performed yet; when one is, its date will be published here. Uploaded documents, exports and backups are stored in AWS ap-south-1 (Mumbai) with server-side encryption at rest (AES-256); all traffic is encrypted in transit with TLS 1.2 or later. An air-gapped deployment mode disables every external model vendor and all telemetry.
Controls your organisation holds: an IP allowlist, allowed platforms and a maximum session age (Access Policies); a model-tier ceiling, per-feature AI switches, a daily AI spend cap and the AI request history (AI Administration); retention periods per document category; and an append-only audit trail. Identity documents never reach an AI vendor. Multi-factor authentication is not offered yet, and we do not claim it.
- Live system status → API and database, polled in real time
- Data Processing Agreement → including the current sub-processor list
- Sub-processor register (machine-readable) → generated from the running configuration
- Privacy policy → what we collect, and how long we keep it
- Security practices →
- Report a vulnerability → security.txt