Run your security review from this page. Every control names what enforces it.

No. Not SOC 2 Type I, not Type II, not ISO 27001. It has not been started, no auditor is engaged and there is no target date. There is also no third-party penetration test and no bug bounty; the security review is internal and adversarial, but it is our own. If your procurement floor requires any of those, you cannot buy this today, and it is worth establishing that on the first call. What does exist is a trust document naming the file, test or architectural decision that enforces every claim it makes, so each control can be checked rather than taken on trust. The gap between that and SOC 2 is the independent attestation that the controls operated over a period.

By application-enforced tenant scoping, and the exact shape of that matters. Every table carries a tenant id; every persistence method requires it as a keyword argument with no default, so a forgotten argument raises rather than silently reading a shared tenant; reads scope in SQL before retrieval rather than filtering after it; and the replay cache is keyed on a composite primary key, so byte-identical content from two customers resolves to two separate entities. A wrong-tenant read is a 404, never a 403. What it is not is database-enforced: one database, one schema, one runtime role, no row-level security, so a SQL-injection defect would cross every tenant at once. The internal workbench sits outside that guarantee.

Erasure runs per entity or per record, in one transaction across eight targets: the entity's facts, the keys that index it for matching, every submitted record it holds, open review items embedding one of those records, settled review items redacted rather than deleted, the replay fingerprints, cached responses quoting it, and the entity row. There is deliberately no bulk delete and no "delete my tenant" button, because a single call that empties a tenant turns one mistyped id into an unrecoverable loss. One limit to read before you rely on it: the decision audit trail survives, and a surviving decision row can carry cited evidence and an adjudication rationale naming the company. It expires on the retention window rather than on request.

Four separate retention windows, each its own command — decisions, records and usage default to 2,555 days, and open review items to 365. Seven years is chosen to clear the money laundering regulations' five-year duty to retain the evidence behind a customer due-diligence decision; below about five years, a know-your-business customer loses what they are legally required to produce. The windows are environment variables you can change: set record retention to 90 days and you have 90-day retention. One caveat outranks the rest, and our own trust document states it first: nothing purges itself. Every window is a scheduled job an operator has to run, and an unscheduled deployment retains everything for ever.

Yes, on the records that reach adjudication or research, and it is worth being exact about what travels. The adjudication prompt renders the candidate record's populated fields — including the submitted address — plus the free-text context and the entries of the `extra` map, so a CRM column mapped into `extra` reaches the model verbatim. The research agent uses the provider's own server-side web tools, so search queries and fetched URLs reach them too; if "which companies is this customer looking at" is sensitive, that signal reaches them. Two things do not exist and should not be assumed: a zero-data-retention addendum, and any code-level enforcement of the provider's not-used-for-training term, which is contractual. Setting `depth=probabilistic` sends nothing at all.

One model provider and a set of public registers, published as a table and kept honest by a build-failing test that reads the request URL off every wired adapter and fails continuous integration if a host is missing from the list. The registers are Companies House and its document service, GLEIF, SEC EDGAR, INSEE SIRENE via the French state search service, Brønnøysund, plus wired adapters for Finland, Czechia, Poland, EUIPO and USPTO. There is no reseller, and no analytics or session-recording tag anywhere in the product. One disclosure a reviewer needs before mapping a country column: the French service is on by default and needs no credential, so a record stating no country will have its name sent there unless you disable it.

The artefact is one container plus a database, configured entirely by environment variables, and it runs wherever it is run — including a deployment we run for a customer. There is no managed multi-region offering and no region to pick on a form, so data residency here is a conversation about where that deployment sits rather than a checkbox somebody ticks. One thing not to infer from that: the sub-processor calls do not move with it. A deployment sitting in the EU still reaches a US-hosted model provider on the records that escalate, US federal hosts for SEC filings, UK and global hosts for Companies House and GLEIF, and a French state service for SIRENE. The only setting that sends nothing anywhere is the probabilistic depth cap.

Not one that is already drafted and waiting, so there is no request-our-DPA button to press. A documented data processing agreement, standard contractual clauses and a zero-data-retention addendum with the model provider are all prerequisites for a regulated EU buyer, and all three are outstanding. The published position covers what the code does — the erasure and portability endpoints, the retention reasoning, the licence handling, tenant scoping and the sub-processor list — and stops there rather than asserting a lawful basis, a controller or processor determination, or a transfer mechanism it has not documented. Send the questions to our security address and you will get a straight answer, usually the same week.