Your security team will ask the questions. We've already answered them — with certifications, isolation by design, every answer auditable, and an option to run inside your own perimeter.
No gated forms. No multi-step requests. The things we can publish are downloadable below — the rest are an email away.
MFA, SSO with Okta, Microsoft, and Google. Scoped API keys with rotation built in.
TLS 1.3 in transit. Per-organization IP allow-listing. Private networking available for Enterprise.
Every request authenticated, authorized, and logged. Nothing happens without a paper trail.
AES-256 at rest. Tenant isolation enforced at the database — not as an application check.
Audit logs retained 90 days by default, longer on Enterprise. Every answer is re-runnable on demand.
Sub-processor list published and updated quarterly. You can object to any change before it goes live.
Six months later, your compliance team can replay any query — same sources, same answer. The example below is a real audit record.
Full transparency on every vendor in the path. Customer right of refusal on changes.
Production lives in AWS us-east-1 by default. EU-resident customers get eu-west-1. Self-hosted customers control their own region — we never touch the data.
No. Customer content never leaves your tenant for training. Our LLM providers are configured with training opted out, in writing.
We give 30 days' notice. Enterprise customers have a contractual right to refuse — we'll route around it or work out a custom path.
Yes. We provide a Helm chart and reference deployment for Kubernetes. Some Enterprise customers run fully offline with internal models.
On-call rotation, 30-minute customer comms SLA for confirmed incidents, public post-mortem within 14 days. We've published every one we've had.
30 minutes with a solutions engineer. Bring a real question your current tools couldn't answer — we'll wire up a connector and try it live.