Security and trust,
by default.
Audited, certified, continuously monitored.
SOC 2 Type II
ActiveIndependently audited controls for security, availability, and confidentiality — report available under NDA.
GDPR
CompliantData processing agreements, EU data handling, and data subject request support.
CCPA
CompliantCalifornia consumer privacy rights honored across data access, deletion, and opt-out.
ISO 27001
In progressInformation security management system certification underway, targeted for this year.
HIPAA
ReadySafeguards and BAAs available for brands handling regulated health-adjacent data.
Security built into every layer.
Encryption everywhere
Data encrypted in transit with TLS 1.2+ and at rest with AES-256. Keys managed and rotated automatically.
SSO & SAML
Enterprise single sign-on via SAML 2.0 and OIDC, with SCIM provisioning for managed user lifecycles.
Role-based access
Granular RBAC with least-privilege defaults so people only see the accounts and data they need.
Audit logging
Every access and material action is logged and exportable, giving your team a complete audit trail.
Tenant isolation
Your data is logically isolated per customer — never commingled and never used to train shared models.
Penetration testing
Independent third-party penetration tests run regularly, with findings tracked to remediation.
Continuous monitoring
Vulnerability scanning, anomaly detection, and 24/7 alerting across our infrastructure.
Vendor risk review
Every subprocessor is security-reviewed before onboarding and reassessed on an ongoing basis.
How we handle your data.
Clear answers to the data questions that come up in every enterprise review — before you have to ask them.
Your data stays yours
You own your data. We process it only to deliver the service you've configured — nothing more.
Never used to train shared models
Your data is never used to train models that benefit other customers. Tenant boundaries are enforced.
Data minimization
We collect and retain only what's needed to run your agents, and we make retention windows explicit.
Deletion on request
Request deletion at any time and we remove your data within the contractually agreed window.
Regional data handling
Data is processed in US regions by default, with data processing agreements available for EU requirements.
Where your data lives.
| Category | Purpose | Region |
|---|---|---|
| Cloud hosting | Application infrastructure, compute, and encrypted storage | United States |
| AI model providers | LLM inference for agent reasoning, under zero-retention terms | United States |
| Observability | Logging, monitoring, and error tracking | United States |
| Transactional email | Service notifications and account communications | United States |
The complete, current subprocessor list is available under NDA as part of our security package.
Questions security teams ask.
Can we review your SOC 2 report?+
Yes. Our SOC 2 Type II report is available under NDA as part of the security package — request it and we'll share it with your team.
Is our data used to train AI models?+
No. Your data is never used to train models shared with other customers. Model providers operate under zero-retention terms.
Do you support SSO and provisioning?+
Yes. We support SAML 2.0 and OIDC single sign-on, plus SCIM provisioning so user access follows your identity provider.
Where is our data stored?+
On hardened, US-based cloud infrastructure, encrypted in transit and at rest. Data processing agreements are available for EU requirements.
How do you handle vulnerabilities and incidents?+
We run continuous vulnerability scanning and regular third-party penetration tests, with a defined incident response process and customer notification commitments.
Can you complete our security questionnaire?+
Absolutely. Our security team regularly completes vendor questionnaires (CAIQ, SIG, and custom) and joins security review calls.
Bring Serve to your security review.
Talk to our security team or request the full security package — SOC 2 report, subprocessor list, and questionnaire responses.