Built for the rooms where the answer has to hold up.

Our security program is engineered for the stringent requirements of financial services, healthcare, utilities and government: the rooms where every number, every citation and every access event has to defend itself under scrutiny.

Request the security documentation

Section 01

SECURITY FEATURES

Six controls. Every layer covered.

Encryption

All data is encrypted at rest (AES-256) and in transit (TLS 1.3).

Infrastructure

Hosted with a SOC 2 attested cloud provider, with redundancy.

Access Control

Role-based access control with multi-factor authentication.

Audit Logging

Comprehensive audit trails for every user action and data access.

Single sign-on

SAML 2.0 single sign-on on Enterprise plans, configured by your own org admin.

Vulnerability Management

Continuous monitoring with scheduled vulnerability assessments.

Section 02

COMPLIANCE

Aligned with the standards your auditors already trust.

Last reviewed 15 September 2026

SOC 2: Type II in progress (provider attested)
GDPR: Compliant
CCPA: Compliant
ISO 27001: Aligned

Section 03

OVERSIGHT

What your admins can see, and what the model runs on.

Answer feedback: Every answer takes a rating and a comment from the reader, kept with the answer.
Citation registry: Every answered query is recorded with the sources that grounded it, in the Trust Center.
Flagged claims: A claim the verifier could not ground is listed with its verdict, never counted as verified.
Audit log: Every user action and data access, viewable by org admins and exportable.
Single sign-on: SAML 2.0, on Enterprise plans.
Model providers: OpenAI runs the hosted service. Anthropic, Cohere, Azure OpenAI and Mistral are wired through the same routing layer and run for a tenant set up with its own key. Self-hosted models are not built.
Connectors: Uploads on every plan. Google Drive from Starter, S3 and Google Drive on Pro, SharePoint and Confluence on Enterprise.

Section 04

DATA RESIDENCY · ROADMAP
INCIDENT RESPONSE

Your data, where your regulator says it has to live.

Region-pinned storage for Enterprise customers, so data stays in the jurisdiction the regulator names, is on the roadmap and not yet shipped. Until it is, ask where your data is hosted before you sign and we will answer in writing.

24/7 monitoring. 72‑hour notification.

We maintain a comprehensive incident response plan with continuous monitoring; what the monitoring sees is published on the status page. In the event of a security incident, affected customers will be notified within 72 hours as required by GDPR and other applicable regulations.

Section 05

INQUIRIES

Questionnaires, pen-test reports, vulnerability disclosure: one request, one address.

Documentation requests

Security questionnaires, penetration test reports, SOC 2 documentation, and other security artifacts, requested through the form. We reply within 24 hours.

Request the security documentation

Responsible disclosure

Report a security vulnerability with details. We acknowledge receipt within 24 hours and appreciate responsible disclosure.

[email protected]

Next step

Ask us the questions your reviewer will ask.

Bring the questionnaire, the pen-test question and the data-residency question. We answer each one in writing, on the record, before you sign.

Request a 30-minute walkthrough View pricing