Security and privacy, in plain terms
Everything BeforeQuery does to keep your knowledge, your users, and your compliance posture safe. Written as a checklist your security team can actually run through.
Data protection
- Workspace isolation across content, embeddings, and conversations
- Encryption in transit and at rest
- PII masking runs before every LLM call (chat, rerank, eval, deflect, agent) — the database only holds the masked form
- Zero-retention mode: per-workspace toggle — questions and answers stream and are dropped, never persisted
- Your data is never used to train models — ours or a third party's
- Delete a source and its indexed content is removed
Identity & access
- SSO via OIDC and SAML 2.0 on Enterprise
- Per-knowledge-base permissions for workspace members
- Restricted-document visibility within a knowledge base
- Client keys scoped per knowledge base, revocable instantly
- Allowed-groups enforcement on integration keys (can narrow, never widen access)
Auditability
- Workspace audit logs for admin actions
- Conversation history with citations preserved
- Traces record retrieval chunks + scores behind every answer
- Approval queues and invocation logs for AI Actions
- Signature verification on every webhook
AI safety
- Abstention gate refuses low-confidence questions rather than hallucinating
- Every answer carries structured citations to source passages
- AI Actions gated by approval rules (sensitive actions default to human approval)
- Public surfaces retrieve only from public documents
- Bring-your-own-model on Enterprise (BYOK): traffic runs on your provider account under your DPA
Certifications and compliance
SOC 2 Type II
In progressVanta-managed. External audit scheduled; the corresponding trust portal will be linked here once live.
HIPAA BAA
Available on EnterpriseContact sales for the BAA and the corresponding technical controls checklist.
GDPR + Standard Contractual Clauses
Available on EnterpriseDPA + SCCs available on request. EU data residency on request.
Regional data residency
Available on EnterpriseUS and EU regions available on Enterprise. APAC on request.
The short answers
Is my content used to train AI models?
No. Indexed content, embeddings, and conversations stay isolated to your workspace and are used only to answer your own questions. Nothing is shared across customers or used to train any model — ours or a third party's. This is contractual on paid plans and technical on every plan.
How is PII handled?
PII (emails, phones, credit cards, common ID formats, personal names) is masked before content reaches any model. The masking applies to every LLM call — chat, reranking, evals, deflection, agents — and to storage. The database holds the masked form; the raw form never leaves the request path.
What is zero-retention mode?
A per-workspace toggle. Questions and answers stream to the caller in real time and are then dropped — no conversation row is created, no feedback can be attached. Retrieval still runs against your indexed content; the answer is still cited. Only the transcript is not persisted.
What data does the LLM provider see?
The retrieved chunks plus the user's (PII-masked) question. Providers we use run under zero-retention API terms (no training on inputs). On Enterprise, BYOK routes traffic through your own provider account under your own agreement.
How do you handle SSO?
OIDC and SAML 2.0 on Enterprise. Members authenticate via your identity provider; per-knowledge-base permissions and restricted-document visibility apply on top.
What if we need EU data residency or a DPA?
Both are available on Enterprise. Contact us for the DPA, SCCs, and the regional-residency configuration.
Bring this to your security review
Request the security whitepaper, DPA, and (once live) the SOC 2 report. Your legal and security teams can send us their questionnaire directly.