Security and compliance
Built for sensitive business records
A message archive holds trade terms, prices, assay results and customer conversations. Each workspace writes into its own storage partition, encrypted at rest under keys that belong to that workspace.
99.99%
Uptime SLA, Scale and up
AES-256
Encryption at rest
EU only
Data residency
In progress
SOC 2 Type II
Infrastructure
European cloud infrastructure
Every system runs across three availability zones in Frankfurt and Amsterdam, with no replica in the United States. Servers are built from code, and opening a production shell needs a documented break-glass approval that pages a second engineer.
Hardened server images
Base images take automated security patches weekly. Containers run rootless with the smallest privilege set that works.
Isolated database networks
Databases sit in private subnets with no public route. Only internal application workers can reach them.
Automated backup runs
Snapshots write to a second European region every 60 minutes. A restore is verified automatically each week.
Disaster recovery targets
The recovery point objective matches the 60 minute snapshot interval, and the recovery time objective is under 2 hours. Both are tested quarterly.
Encryption
Data encryption and key control
Network traffic runs over TLS 1.3 and disk storage uses AES-256-GCM. Per-tenant data keys rotate on their own under a KMS root key. Enterprise accounts supply their own root key and can revoke our access in one action.
In transit
Every incoming connection needs TLS 1.3 with a strict cipher suite. Older protocol versions are switched off.
At rest
Message payloads, metadata, search segments and attached media are stored with AES-256-GCM.
Key hierarchy and rotation
Each tenant gets its own data encryption keys. Root keys rotate every 90 days inside a dedicated KMS.
BYOK and revocation
On Enterprise you hold the root key in your own AWS KMS or HashiCorp Vault, and revoking it locks us out.
Isolation
Tenant data isolation
A customer runs inside its own database schema, with the tenant filter enforced where queries are built rather than where they are written. Search indexes stay separate. Enterprise customers can run the deployment inside their own VPC.
We do not train models on customer messages or metadata. Search runs against partitioned stores, so one workspace has its own indexing boundary and no pooled corpus sits behind it.
Separate schema per tenant
Each workspace owns its own logical database schema. There is no shared messages table.
Tenant id at the query layer
The data access layer refuses to compile a query that does not carry a tenant predicate.
Separate search index
Index shards are partitioned by workspace id, and a query runs only against the shards for the workspace that authenticated it.
No shared model training
Nothing is pooled to train a model used by another customer. PersonaLearn fits a single-tenant adapter.
SELECT … FROM messages — rejected: missing tenant predicate
Access control
Identity and access
Decide how people sign in and which conversations they can open. We plug into your identity provider and require a second factor on every account in the workspace.
Corporate SAML SSO
Route sign-on through Okta, Microsoft Entra ID or Google Workspace over standard SAML 2.0.
SCIM provisioning
Team rosters sync automatically. Removing someone in your directory cuts their session within seconds.
Enforced two-factor auth
A WebAuthn key or authenticator app on every account, with no opt out. Team and above add workspace-wide policy reporting.
Per-thread permissions
Set access rules by channel or by thread, so a junior trader never loads the chairman's WhatsApp.
Audit
Append-only audit log
The log records every search, message read, export, generated draft and permission change, with the actor, the IP address, the timestamp and the object touched. Nothing in it can be edited or removed, including by us.
Stream the events straight into your own SIEM over the webhook or the SDK. We keep our copy for seven years.
Audit event schemaaudit_stream.jsonl
append only2026-08-22T08:41:02Z thread.read actor=r.diamant@… ip=81.82.x.x obj=thr_9fJ2
2026-08-22T08:41:19Z search.run actor=r.diamant@… ip=81.82.x.x q="assay 4.02ct"
2026-08-22T08:44:51Z export.create actor=admin@… ip=81.82.x.x size=2.4GB
2026-08-22T09:02:07Z permission.grant actor=admin@… ip=81.82.x.x obj=chan_wa_07
2026-08-22T09:11:33Z draft.generate actor=y.levi@… ip=81.82.x.x model=personalearn
Certifications
The audit that is underway
An outside firm is running our SOC 2 Type II observation window now. Nothing gets published until the report lands, and ISO 27001 comes after it. The control documentation that exists today goes out under NDA.
SOC 2 Type II
An audit in progress across security, availability and confidentiality.
ISO 27001
Planned. An information security management system built for certification later.
GDPR
EU processing, a signed DPA and a named data protection officer.
Request the compliance pack
One archive with the security policy set, the penetration test summary, the standard DPA, the subprocessor registry, our completed SIG questionnaire and a letter stating where the SOC 2 audit stands. The report joins the pack when the audit closes.
Subprocessors
The vendors we use
This registry is current as of August 2026 and we date it on every change. Account owners get an email 30 days before we add a vendor, which gives your security team time to review it or object.
Vendor
Purpose
Location
Data reached
Discord Netherlands B.V.
Internal alerting for website enquiry and access-request forms
European Union, with transfers to the United States under the DPF
Work email, company and the message typed into a website form
Amazon Web Services EMEA
Primary compute, object storage and KMS
Frankfurt, Germany (eu-central-1)
Message content, media, encryption keys
Google Cloud EMEA
Secondary region for Amsterdam residency
Amsterdam, Netherlands (europe-west4)
Message content, media
Cloudflare Germany GmbH
Edge TLS termination, DDoS filtering, WAF
EU-only edge configuration
Request metadata, IP addresses
Mistral AI SAS
Summaries, classification and translation
Paris, France
Message text sent for the requested task, zero retention
Twilio Ireland Limited
SMS and voice channel carriage
Dublin, Ireland
Phone numbers, SMS bodies, call metadata
Meta Platforms Ireland Limited
WhatsApp Business API, when you pick that route
Dublin, Ireland
WhatsApp message content and phone numbers
Mailjet SAS
Transactional and notification email
Paris, France
Recipient email address, notification body
Stripe Payments Europe Limited
Card processing and invoicing
Dublin, Ireland
Billing name, billing email, card token. No message content
Anthropic PBC
off by defaultOptional drafting model for PersonaLearn
EU inference region
Draft prompt text, zero retention
Voice transcription, media understanding and the search index run on hardware we operate in Frankfurt. Neither one appears on this list because neither one leaves our own racks.
Data residency
Where the data lives
Primary stores sit in Frankfurt or Amsterdam, and you choose which at signup. EU customer records stay on EU servers, with no replica outside the region. Enterprise customers deploy into their own VPC in the region they pick.
Retention and deletion
When it goes away
You set the purge rule, anywhere from 30 days to permanent. A deletion runs against the live database immediately and works through backup copies within 14 days. A legal hold on a named thread overrides the purge rule until you lift it.
Vulnerability disclosure
Report a vulnerability
Write to [email protected] and ask for our PGP key in the first message. We send it back before you share any detail, acknowledge inside one business day and pay a bounty for a valid report. Good faith research gets safe harbour.
Send the review to your CISO
Read the compliance pack under NDA, sign the DPA, then plan the rollout with us. A self-serve account connects accounts the same week and an enterprise deployment runs six to eight weeks.