Security and compliance

The Trust center lists our security controls, subprocessors, and compliance status. Request our security documents and Data Processing Agreement there.

Data protection

Prompts and model outputs pass through our servers and are never stored.
Account and usage records (the model, token counts, and cost of each request) are kept for billing, security, and reliability.
We never sell your data.
Protections include encryption in transit, encrypted backups, passwords and API keys stored only as hashes, and two-factor authentication for admin access.

See the privacy policy.

Security assessments

SOC 2 Type II, ISO 27001, and CSA STAR Level 1 are in progress. Our security overview and security questionnaire (CAIQ v4) are available on request from the Trust center.

Enterprise requirements

See Single sign-on and HIPAA. For other security, contract, or data protection requirements, talk to us.

Vulnerability reporting

Email [email protected]. To encrypt your report, use the PGP key on our contact page.