SCR · Data and processing
Understand your workspace boundary
Access, AI destinations and infrastructure control are separate questions. Your workspace shows its recorded policy and processing evidence.
Public verification status
No independent certification or attestation evidence is published on this page. “Not verified here” describes this evidence limit; it does not establish an audit’s engagement, completion or absence elsewhere. An explanation link is not an auditor’s opinion or a live deployment check.
SOC 2 Type II report
SOC 2 Type II reportNot verified hereNo independent SOC 2 report is published here. A planning record or implemented feature does not establish an audit opinion.
ISO 27001 certification
ISO 27001 certificationNot verified hereNo current certificate or assessed scope is published here. Verification requires the issued certificate, its scope and issuing body.
Privacy controls
Privacy controlsNot verified hereInspect recorded workspace policies, processing receipts and rights outcomes where available. These records are not a platform-wide GDPR compliance determination or proof of completed deletion.
Processing locations
Processing locationsNot verified hereStorage, AI processing, telemetry and backups may use different services. This page does not verify their regions, retention settings or contractual transfer basis.
Encryption at rest
Encryption at restNot verified hereNo platform-wide at-rest encryption or managed-key deployment is attested here. Request current storage, backup and key-management evidence for the agreed deployment.
Transport security
Transport securityNot verified hereHTTPS and supported protocol versions require checks on the endpoint in use. This page does not verify encryption across every internal or provider connection.
Logical isolation
Access is evaluated by organization, role and object permissions. Effective deployment configuration and authorized operations determine the actual boundary.
Dedicated deployment
Dedicated components and credentials require explicit provisioning. A dedicated deployment can still use approved external AI services.
Contained processing
Inference, extraction, embeddings, reranking and content telemetry must remain within a defined supported boundary. A local model alone does not establish this.
What evidence can establish
A route declaration, an attested account setting and an observed processing attempt establish different facts. No-training terms do not mean zero retention. Masked telemetry does not mean source text was anonymized before a provider received it.
A timeout can leave transmission uncertain. An accepted erasure request is not completed deletion; local records, provider copies, retained provenance and backups have separate outcomes and limitations.
Your actual configuration
Sign in to inspect your effective policy, permitted route revisions, processing records and scoped rights requests. This explanatory page is not a compliance certification or a promise of a dedicated or sovereign service.
Open workspace privacy & AIAnalysis and record limits
Investor Fit comparisons retain their selected profile and transaction context. Recorded source references, versions and human review states support inspection; missing references and changed sources still need review. This page does not attest universal citation coverage, immutable storage or identical AI answers on rerun.