Silk Compute Trust Center
Silk Compute maintains a security program to protect customer data. Here you can find our compliance work, security controls, subprocessors and security documents.
Do you use customer data to train models?
No. Silk Compute does not store prompts or model outputs and never uses them to train models.
Do you store prompts and responses?
No. Prompts and model outputs pass through our servers and are not stored. We keep billing records, such as token counts and cost.
Are prompts or responses included in logs?
No. Our logs record request metadata, such as the time, model, status and token counts.
How is customer data protected?
We use encryption in transit, restricted and key-only production access, sandboxed services, security monitoring and daily security updates. Support tickets are also encrypted at rest.
Do you back up customer data?
Yes. The database is backed up every day, encrypted before it leaves our servers, to separate cloud storage, where each backup is kept for 30 days. Restores are tested every quarter.
Do you offer a Data Processing Addendum?
Yes. Our DPA describes how we process personal data and our data protection obligations. Request it through Request access in this Trust Center.
Which subprocessors do you use?
Our Subprocessors page lists the providers supporting our services and their purposes.
Do you conduct penetration testing?
Yes. Our latest internal penetration test of the platform and API was completed in November 2026. A summary attestation is available through Request access.
What is your SOC 2 and ISO 27001 status?
Our SOC 2 Type II, ISO 27001 and CSA STAR Level 1 work is in progress. Use Request access to discuss your requirements.
How do I access restricted security documents?
Select Request access, tell us who you are and which documents you need. We review every request and reply within one to two business days.
How do I report a security vulnerability?
Email [email protected] with a description and steps to reproduce it. For anything sensitive, encrypt it with the PGP key on our contact page.
Who can access production systems?
Only authorized administrators. Server access requires a unique SSH key, and the admin dashboard also requires a one-time code.
What happens to my data when I delete my account?
Your account, API keys, usage and payment history are removed from our database right away. Stripe keeps its own records of card payments, and logs and backups that include your details are removed as they age out.
Will you notify me of a security incident?
Yes. No system is perfectly secure, so if something goes wrong that affects you, we will tell you.