Security
Security is shown as mechanism, not stated as a claim.
Every claim here arrives with the mechanism that delivers it. There is running code behind each line.
- Controls
- 10
- Ephemeral TTL
- 1 hour
- Raw PII logged
- none
- Completed audit
- none
Zero data retention
Data we do not keep cannot be leaked.
“Zero data retention” is a policy sentence in most products. Here is the mechanism:
Never written to the persistent pool
Files uploaded in chat never enter the persistent knowledge base. There is no write path to the persistent vector pool in this flow.
Only masked text
What enters the ephemeral store is text that has already passed the masking engine. Raw content is never stored at any stage.
Scoped to (tenant, session)
The key is that pair. Cross-tenant and cross-session leakage is prevented by structure, not by a check.
Expires on its own
Each entry lives on a one-hour window, renewed on every write. Abandon the session and the data falls away; a reset deletes it immediately.
Controls
What exists, and what it does.
The list your security review can go through line by line.
Identity and authorisation
| Enterprise SSO | OIDC authorization-code flow (Azure AD and generic OIDC), with state and nonce validation. |
| Permission-based authorisation | Endpoints gate on the permission, not the role name; the two most sensitive permissions come with no role. |
| Step-up approval | Reading a raw value from the vault needs a fresh, per-action approval; the window is 5 minutes. |
Secrets
| API keys | Only the SHA-256 hash of a tl_-prefixed key is persisted. The raw value is returned to the caller exactly once. |
| Production guard | In a production environment mock data, relaxed auth and the stub model are forced off, and env-based keys are refused. |
Data
| Column-level encryption | Sensitive JSON columns are written as pgcrypto-encrypted bytea; the key is read from the environment at query time. |
| Ephemeral session store | Files uploaded in chat are never written to the persistent knowledge base; only masked text is kept, with a TTL. |
Isolation
| Tenant and session scoping | The ephemeral key is the (tenant, session) pair; cross-tenant and cross-session leakage is structurally impossible. |
Audit
| Immutable audit log | Every decision produces an event; raw personal data never enters that stream. |
| SIEM export | Events are batched to Splunk HEC, Elastic Bulk or a webhook; a failed delivery is retried three times with backoff. |
Misconfiguration is a threat too
When the environment is marked production, mock data, relaxed authentication and the stub model are forced off; no combination of environment variables can turn them back on. Every flag that had to be overridden is written loudly to the boot log, so a misconfigured deployment cannot stay quiet. Static environment keys are refused in production: they carried no identity and derived the role from a header, which made them a privilege-escalation surface.
Compliance
Where we actually are.
In a security review, these lines being verifiable matters more than their looking good.
| KVKK | aligned | Controls are designed in line with the data-security obligations of Turkey's KVKK. |
| GDPR | aligned | Administrative endpoints exist for portability and erasure requests. |
| ISO 27001 | aligned | The control set is mapped to ISO 27001 headings; no certification process has begun. |
| SOC 2 Type II | in-progress | In progress. We do not hold a completed audit report. |
See it with your own data.
In a technical session we run your prompts and your policy through it live.