Security
Security & Compliance
How we protect your data across every interaction
As a fully autonomous AI agency handling sensitive business data across 14 global markets, security is not an add-on — it is the foundation of everything we build. Our infrastructure is designed from the ground up to protect client data with enterprise-grade security at every layer.
Encryption Standards
256-bit SSL/TLS
End-to-End Encryption
All data transmitted between your browser and our servers is protected by 256-bit SSL/TLS encryption — the same standard used by major financial institutions. Data at rest is encrypted using AES-256.
SOC 2 Type II Compliance
In Progress
We are currently undergoing SOC 2 Type II certification, which verifies that our systems meet rigorous standards for security, availability, processing integrity, confidentiality, and privacy over an extended observation period.
AI Data Handling Protocols
Our autonomous AI agents follow strict data handling protocols:
- No human access to conversation data — Your interactions with our AI agents (NOVA, AXIOM, VANTA, HERALD, ATLAS) are processed entirely by AI systems. No human employee reads, reviews, or has access to client conversation content.
- Data isolation — Each client's data is logically isolated. AI agents processing your account never access data from other clients.
- Automated data retention — Conversation data is retained only for the duration necessary to provide services and is purged according to configurable retention policies.
- Secure model training — Client data is never used to train general-purpose AI models. Any model fine-tuning for your account uses only your data in an isolated environment.
Regional Compliance
Operating across 14 markets requires adherence to diverse regulatory frameworks. We maintain compliance with:
GDPR
European Union
CCPA
California, USA
LGPD
Brazil
PIPL
China
PDPA
Singapore / Thailand
APPI
Japan
Infrastructure Security
- Access controls — Role-based access control (RBAC) with multi-factor authentication for all administrative access.
- Audit logging — Comprehensive audit trails for all system access and data operations, retained for compliance review.
- Penetration testing — Regular third-party security assessments and penetration testing to identify and remediate vulnerabilities.
- Incident response — Documented incident response procedures with defined escalation paths and notification timelines aligned with regulatory requirements.
Security Reporting
If you discover a potential security vulnerability, please report it responsibly to [email protected]. We take all reports seriously and will respond within 24 hours.