For IT, risk and compliance
Every AI action has to be defensible.
Controls are selected for each deployment scope, documented for review and improved as the assurance program matures. Here we state what is available and what is still in progress.
Controls
Encryption
TLS 1.2 or higher in transit and AES-256 at rest. Key ownership and any customer-managed-key requirement are confirmed during solution design.
Access control
Resource-level role-based access and single sign-on via SAML 2.0 or OIDC. Identities, service accounts and privileged access are documented for the deployment.
Human approval and records
Writes to your systems and high-impact actions require human approval. Approvers and limits are defined per deployment. Calls, approvals and outcomes are recorded for review.
Monitoring and response
Logging, monitoring and incident-response responsibilities are defined per deployment. Notifications follow applicable law and the customer agreement.
Data residency
Hosting regions and any residency requirement are confirmed before deployment and recorded in the customer agreement. Customer-submitted content is never used to train shared or third-party foundation models.
Sub-processors
The sub-processor list is provided during due diligence. Change-notification commitments are defined in the agreement or data-processing addendum.
Compliance status
No embellishment: what we have, what's in progress and what we don't claim.
- SOC 2 Type IIReadiness in progress. We do not claim a Type II report.
- ISO/IEC 27001Controls mapped internally. We do not claim certification.
- Law 21.719 (Chile)Preparation in progress ahead of its 1 December 2026 effective date.
- GDPR and CCPAThe platform is designed to support customer obligations.
- Penetration testingOn the roadmap. Current scope and evidence are disclosed during a security review.
Our commitment: state what is available, what is still in progress and what evidence can be reviewed.
Need a security review?
Send us your questionnaire or request a review with engineering. To report a vulnerability, write to us directly.