Grounded · Isolated · Traceable · Encrypted · Deterministic
Every answer is drawn from your sources. Every write goes through your approval rules. Every credential is encrypted at rest and in transit. Every step is replayable and reversible. Written as a checklist your security team can actually run through.
What every BeforeQuery answer and action promises.
Answers come from your sources. When we do not have the answer, we say so.
Your data never trains a global model. Bring your own model if you want.
Every action ships with the sources that justified it and the entities involved.
TLS 1.3 in transit. AES-256-GCM at rest. Per-workspace key envelope.
Playbooks execute the same way every time. Human approval where policy demands it.
Data protection
- Workspace isolation across content, embeddings, and conversations
- Encryption in transit and at rest
- PII masking runs before every LLM call (chat, rerank, eval, deflect, agent) — the database only holds the masked form
- Zero-retention mode: per-workspace toggle — questions and answers stream and are dropped, never persisted
- Your data is never used to train models — ours or a third party's
- Delete a source and its indexed content is removed
Identity & access
- SSO via OIDC and SAML 2.0 on Enterprise
- Per-knowledge-base permissions for workspace members
- Restricted-document visibility within a knowledge base
- Client keys scoped per knowledge base, revocable instantly
- Allowed-groups enforcement on integration keys (can narrow, never widen access)
Auditability
- Workspace audit logs for admin actions
- Conversation history with the sources that supported each answer preserved
- Traces record retrieval chunks + scores behind every answer
- Signature verification on every webhook
AI safety
- Abstention gate refuses low-confidence questions rather than hallucinating
- Every answer carries the source passages it was drawn from
- AI Actions gated by approval rules (sensitive actions default to human approval)
- Public surfaces retrieve only from public documents
- Bring-your-own-model on Enterprise (BYOK): traffic runs on your provider account under your DPA
Certifications and compliance
SOC 2 Type II
In progressVanta-managed. External audit scheduled; the corresponding trust portal will be linked here once live.
HIPAA BAA
Available on EnterpriseContact sales for the BAA and the corresponding technical controls checklist.
GDPR + Standard Contractual Clauses
Available on EnterpriseDPA + SCCs available on request. EU data residency on request.
Regional data residency
Available on EnterpriseUS and EU regions available on Enterprise. APAC on request.
The short answers
Is my content used to train AI models?
No. Indexed content, embeddings, and conversations stay isolated to your workspace and are used only to answer your own questions. Nothing is shared across customers or used to train any model — ours or a third party's. This is contractual on paid plans and technical on every plan.
How is PII handled?
PII (emails, phones, credit cards, common ID formats, personal names) is masked before content reaches any model. The masking applies to every LLM call — chat, reranking, evals, deflection, agents — and to storage. The database holds the masked form; the raw form never leaves the request path.
What is zero-retention mode?
A per-workspace toggle. Questions and answers stream to the caller in real time and are then dropped — no conversation row is created, no feedback can be attached. Retrieval still runs against your indexed content; the answer is still cited. Only the transcript is not persisted.
What data does the LLM provider see?
The retrieved chunks plus the user's (PII-masked) question. Providers we use run under zero-retention API terms (no training on inputs). On Enterprise, BYOK routes traffic through your own provider account under your own agreement.
How do you handle SSO?
OIDC and SAML 2.0 on Enterprise. Members authenticate via your identity provider; per-knowledge-base permissions and restricted-document visibility apply on top.
What if we need EU data residency or a DPA?
Both are available on Enterprise. Contact us for the DPA, SCCs, and the regional-residency configuration.
Bring this to your security review
Request the security whitepaper, DPA, and (once live) the SOC 2 report. Your legal and security teams can send us their questionnaire directly.