Security for information that matters.

All data is encrypted in transit and at rest, with an additional envelope layer for uploaded files and sensitive fields. Key management runs on our own FIPS-validated HSMs in our colocation facility — keys never leave hardware we control.

Bare-metal database and HSM clusters sit behind hardware firewalls on segregated network segments; only the application tier can reach them, on specific ports from specific hosts. Those hosts run full-disk encryption with keys sealed in TPM. Administration happens over a physically separate management network with zero-trust access, and security events across hosts and services feed a central SIEM.

Authorization runs at a single enforcement perimeter — identity, role, and permission checks pass before any handler code executes. Record history is captured by the database itself, so the audit trail exists independent of application code.

Uploaded content is encrypted under keys scoped to your organization — one organization's keys never protect another's data. Model providers process requests under terms that prohibit training on customer content; each provider is named in the privacy policy.

The design assumes any single safeguard can fail, and layers them so one failure does not expose your data: encryption, network segmentation, and scoped access each stand on their own. Audit logging and request-level tracing mean that if something does go wrong, we can establish precisely what was affected — and tell you, rather than guess.

The providers involved in answering questions are identified in the privacy policy and process requests under terms that prohibit training on customer content. Search indexes built from your documents serve only your organization.

Organization membership is the isolation boundary — for a family account, the household is the organization. Roles gate individual permissions within it. Staff support access goes through an explicit, audited mechanism — there is no ambient back door.