Security & compliance
Built for procurement.
Every answer is auditable. Every crawl is compliant. Every revocation is timed and documented. Below is the shipping list — the longer security questionnaire deck and Type I SOC2 report are available under NDA.
robots.txt + AI permission headers on every fetch
Every request the crawler issues respects robots.txt, the X-Robots-Tag header, and Content Signals headers (the standard mechanism for declaring AI-search permissions per page). Origins that disallow AI ingestion are skipped server-side; the policy mismatch is surfaced on the tenant's admin dashboard. The Crawl Compliance Inspector on /product/crawl walks through the gates URL by URL.
see /product/crawl →Immutable audit log on every conversation
Every crawl, every retrieval, every generation writes a structured event to append-only storage with object-lock retention. We never edit or delete an audit record, and we publish a documented retention policy (default 90 days, configurable to 7 years on Enterprise). When procurement asks 'prove you only fetched the URLs we approved' or 'show me every answer the bot gave a customer last Tuesday' — we hand them a signed log.
Personal data is masked before it reaches the AI
Before any content is indexed or any answer streams to a customer, it runs through an AI safety filter with our PII ruleset. Detected emails, phone numbers, government IDs, payment data, and free-form sensitive identifiers are masked with stable hash placeholders. The mapping is encrypted at rest and only re-resolved when explicitly authorised — e.g., when an operator runs a customer-support workflow that needs the original value.
Per-source permission scopes
Every source in a tenant carries an ACL: allowed query origins, allowed user roles, allowed locales. A query against the chat API is matched against scope before retrieval; out-of-scope queries either route to a different source or refuse with a documented reason. Useful for multi-region SaaS, regulated industries, and B2B with tiered customer access.
SAML/OIDC SSO + SCIM provisioning
Enterprise tenants get full SAML 2.0 / OIDC integration with the major IdPs (Okta, Azure AD, Google Workspace, Auth0, custom). User lifecycle is managed via SCIM 2.0; deprovisioning at the IdP cuts off admin and widget-key access in under a minute via a synchronous propagation path.
Enterprise tier →Widget API key revocation — 60s ceiling
Widget keys are cached at the edge for fast validation; cache propagation is eventually consistent globally with a documented ~60-second ceiling. For high-stakes revocations — a compromised key, a terminated customer — we additionally set a revoked-at flag in our authoritative store, and the bot checks that flag on every cache miss. The result: sub-second revocation in the worst case, ~60-second worst-case propagation when the key was already cached. We document the window in the security policy rather than burying it.
SOC2 Type II — in progress
We're in active SOC2 Type II audit (drata.com, observation period started 2026-Q2). Type I report is available under NDA; Type II expected mid-2027. The corresponding audit-readiness work — code-level access controls, change management, vulnerability management, vendor reviews — is documented and continually inspected. Request the report from the form below.
Data flow at a glance
Where your data lives, and how it moves.
- Crawl input — URLs you authorise, fetched through a managed headless browser. Every fetch checks robots.txt and AI-permission headers before reading a page.
- Raw storage — encrypted at rest, isolated per tenant. Never indexed by search engines, never shared across tenants.
- PII masking — AI safety filter before any content is indexed. The mapping from masked placeholder to original value is encrypted at rest.
- Search index — per-tenant namespace. Cross-tenant queries are a privilege violation and refused server-side.
- Answer generation — through approved AI models with citation requirements enforced. Every claim must link to a specific page; unsupported claims are stripped before the customer sees them.
- Audit log — every step writes a structured event to immutable storage with object-lock retention.
Request the security pack.
SOC2 Type I report, security questionnaire, sub-processor list, DPA template, and architecture diagram. Sent to your verified work email within one business day.