Security & Trust
Controls on the platform that manages your controls.
What is built into the product, and what we will publish once it is confirmed by engineering. The second list is on this page deliberately: a trust page that only shows the good half is not a trust page.
In the product
Six things the application does today.
Each of these was read in the application on 18 September 2026.
- AI and your dataChoose cloud, on-premise or hybrid models. Per-task routing keeps sensitive work inside your perimeter. Keys are encrypted at rest and masked on screen, and every AI request emits an audit event.Where it lives
- Access controlRole-based permissions across nine areas, separation-of-duties rules, and single-session enforcement that signs out a second login.Where it lives
- Audit trailEvery recorded change, filterable by module, event, actor and date.
- ApprovalsMulti-stage maker-checker chains with SLA escalation on policies, attestations and exceptions.Where it lives
- Sign-inEmail and password, with single sign-on available per tenant.
- DeploymentSaaS, single-tenant or on-premise, with data residency and on-premise AI models.
Not published yet
Three things we will not claim until they are confirmed.
Hosting, certifications and the AI data statement are the questions a security reviewer asks first. They are also the three the Product Team has flagged as unconfirmed, so none of them appears above.
PendingHosting and encryption
Cloud region, encryption in transit and at rest, backup, and RTO/RPO targets.
Engineering
PendingCertifications
Only certifications actually held will be listed, with their dates. None is claimed until then.
Engineering and legal
PendingAI data statement
Provider no-training and residency terms, with wording agreed by engineering and legal.
Engineering and legal
Bring your security reviewer to the demo.
The parts that are built can be shown: the role matrix, the audit trail, the approval chain and the model routing.