Security & compliance

AI automation security built for procurement reviews, not just demos.

A precise view of implemented controls, plan-dependent capabilities, contract-specific commitments, and the assurance work still on our roadmap.

Get a demo Review trust center

IdentitySSO + SCIM

EncryptionContracted key options

IsolationTenant-scoped

AuditExport + stream

Identity & access

Your team logs in with the accounts they already have — and access stays under your control.

Single sign-on with the providers you already use — Okta, Microsoft, Google, Ping, JumpCloud, OneLogin, Duo, and more (SAML/OIDC)
SCIM can remove access after the identity provider sends and AIDevPortal successfully processes the deprovisioning update
We respect your existing multi-factor login rules and never weaken them
Everyone gets only the access their role needs — nothing more
Separate, limited accounts for system-to-system connections

Encryption

Your data is encrypted in transit and at rest, with Enterprise key-management options.

Strong encryption for your data both stored and in transit (AES-256, TLS 1.3)
Enterprise key management can integrate with AWS KMS or HashiCorp Vault when included in the deployment agreement
Tenant-bound envelope encryption keeps wrapped data keys separated by workspace
Unwrapped keys are not persisted; they exist transiently in protected application memory when needed for authorized operations
Rotation preserves access to data protected with earlier key versions; the exact rotation procedure is documented during implementation

Multi-tenant isolation

AIDevPortal is a multi-tenant SaaS platform with logical tenant isolation at multiple layers.

Authorization and tenant context are enforced at the application and database access layers
Separate caching, usage tracking, and limits for each customer
Every AI request stays tied to your account and is fully logged
Your files live in your own space, with access links that expire within minutes
Dedicated infrastructure is available only when separately scoped, validated, and contracted

Audit logs

A complete, tamper-evident record of every important action — who did what, and when.

A log that can only be added to, never quietly edited
Keep records as long as you need (from 30 days on Starter up to multi-year on Enterprise)
Download as a spreadsheet, or stream into your security monitoring tools (Splunk, Datadog, and others)
Search and filter logs in the dashboard, or pull them through the API
Implemented security-relevant dashboard, API, and workflow events record actor, action, and result context

Data residency

Residency commitments are made only after the deployment architecture is validated.

US hosting is the standard deployment
Alternative residency is contract-specific and available only after technical and subprocessor validation
An order form identifies the covered data categories, region, and any permitted support or provider processing
No residency region is implied merely by selecting an Enterprise plan

Network controls

Lock down who can connect, and send activity to your own security tools.

Limit dashboard and API access to trusted office or VPN networks (IP allowlists)
Private connectivity is available only for validated Enterprise deployment architectures
Outbound connections are monitored and controlled to prevent abuse
Stream activity logs to your security monitoring tools, in real time or in batches

Operations & resilience

Operational commitments are documented at the level the deployed service can support.

Enterprise availability targets and service credits apply only when written into an order form
Encrypted backup, retention, recovery-point, and recovery-time objectives are documented for the contracted deployment
Production changes follow the documented review and deployment process, subject to emergency procedures
Confirmed security incidents involving customer data are communicated without undue delay under the DPA and applicable law
The public Availability page reports website, dashboard, and core API reachability plus the current incident and maintenance record. Historical uptime percentages and dependency-level monitoring are not yet claimed

Compliance program

An active compliance program — here's what's done and what's in progress.

SOC 2 is on the assurance roadmap; AIDevPortal does not currently claim an issued attestation
Privacy program: public DPA, subprocessor register, and data export and deletion process
Do not upload protected health information unless a signed BAA and an approved deployment explicitly permit it
Card data is handled through Stripe-hosted payment infrastructure, minimizing our PCI scope

Responsible disclosure

Report a suspected security issue through a monitored channel.

[email protected] — PGP key on request
Include the affected surface, reproduction steps, impact, and a safe contact method
We acknowledge valid reports and provide status updates as the investigation progresses
No legal action against good-faith research within scope

Get the details

Need our security questionnaire response, DPA, or SOC 2 timeline?

Review the public trust center now. For contract-specific controls, book a 30-minute review and we'll provide the current documentation that applies to the proposed deployment.

Get a demo Review trust center

Loading…