Everything a security, procurement, or compliance reviewer needs in one place: our security posture, honest compliance status, who we rely on, the data-control options you can turn on, and the full legal suite. Where we say “in progress,” we mean it — no badge we haven’t earned. And where words aren’t enough, you can verify our receipts yourself.
The claims below are drawn straight from our contractual commitments in the MSA and DPA — not marketing. They are what we sign up to, in writing.
Full terms govern in the MSA and DPA; the summaries above are for orientation and do not modify those agreements.
“In progress” means an audit is genuinely underway, not a badge we’re implying. We publish only what is true today.
Observation window open; report expected 2026.
Stage 1 readiness underway.
BAA available for healthcare pilots.
Article 12 record-keeping built in; high-risk obligations apply Aug 2026.
SOC 2 is the single compliance-status headline we make, and it reads “in progress” everywhere on this site, including our footer. No certification, customer name, or statistic on this page is fabricated.
Depending on your plan, the following data-control options are available and configurable in Console → Settings. These are real switches, not future promises dressed as certifications.
The sub-processors below handle the control plane the operator runs on. By default, prompt and response content is never handed to them — only hashes and metering.
| Sub-processor | Purpose | Data handled |
|---|---|---|
| Netlify | Static hosting & edge functions | Request metadata |
| Public blockchain (Solana) | Merkle-root anchoring | Root hashes only |
| Managed Postgres | Receipt ledger & metering | Hashes & metering |
| Model providers | Inference (your chosen vendors) | Your prompts, per your config |
Self-host customers replace the ledger and anchoring with their own infrastructure. The current sub-processor baseline mirrors the Trust portal; material changes are reflected there and in the DPA.
Every agreement, published and readable. These govern; the summaries elsewhere on this page are orientation only.
Our real differentiator is that you never have to. Every governed action produces a receipt whose proof you recompute yourself against a public chain we don’t control. Paste a hash and check the math.