Security

Separation between organizationsBuilt

Separation is enforced in the database with Row Level Security, not only in application code. The organization comes from the verified token, never from the request. Automated tests run the policies against a real database on every change.

Who can read conversationsBuilt

Learners see their own conversations. Managers see derived views only, and have no read access to the conversations themselves.

A compliance officer can file a logged request to review a conversation. Our staff reach a conversation only through a time-limited grant with a recorded reason. Every read is logged, and the organization is told.

Tracing assessmentsBuilt

Every change to an assessment is stored with the prompt version, the model and the conversation turn behind it, so you can show how any assessment was reached.

Where data livesBuilt

Data is stored and processed in your region. Our first region is Tel Aviv.

Model inference is separate: for the Israeli cell it runs in an EU region under zero-retention terms. We state this plainly because it's the distinction security reviewers ask about.

Personal details in conversationsBuilt

Before any call to the model we remove email addresses, phone numbers, ID numbers and names the system knows. That reduces exposure, but doesn't guarantee no personal detail reaches the model: a patient's name typed in free text, for example. So learners are asked not to enter patient details.

EncryptionBuilt

Traffic is encrypted with TLS. Data at rest is encrypted with AWS KMS.

Standards and certificationsPlanned

We don't hold any certifications yet. We're aiming for an ISO 27001 audit after our first two paying customers, and we run the controls now.

Reporting a security issue

Found something? Write to [security email].