| X-ray | Shadow period | Guarantee | |
|---|---|---|---|
| What we get | The files you upload | Call metadata, from our exporter | Your model calls, through our endpoint |
| What runs on your side | Nothing | Our exporter, with a read-only key you scope | Your SDKs, pointed at us, with your own keys as the fallback |
| What we could see | Your files | An allowlist of fields: no text, no tool arguments | Every call, in transit |
| Prompt and completion text | Never | Never | Passes through; never stored or cached |
| What we keep | The files | The metadata | Metadata per call, and invoices |
| How long | 90 days after the last step they fed: your report, the shadow period, or the guarantee | 90 days after the period, unless the guarantee starts | The term and 90 days; invoices as long as the law requires |
How it's kept
Where
AWS us-east-1, files and metadata alike. Encrypted in transit with TLS 1.2 or later, and at rest with AWS KMS keys.
Sign-in
One-time codes to your work email, and SAML single sign-on for teams.
Who can read it
Only the staff working on your account, and every read is logged. Ask, and we send you the log.
What we never do
Sell your data, train models on it, or use it to price anyone else.
Your provider keys
Never reach us. They stay in your client, as the fallback.
Our provider accounts
A project of your own at each provider, with zero data retention in place before a guarantee runs on it.
Residency
The US only, for now. For personal data from the EU or the UK, the DPA includes the Standard Contractual Clauses.
SOC 2
A Type I audit before our first guarantee goes live, then Type II. Until then, we answer your security questionnaire in full.
Testing
An independent penetration test of the endpoint before the first guarantee goes live, then every year. The summary is yours under NDA.
Incidents
We tell you within 48 hours of finding a breach that touches your data.
Insurance
Cyber liability, and technology errors and omissions. Certificates on request.
Paperwork
A mutual NDA before the first file, our DPA, and the list of every service that touches your data.
Report a vulnerability