Security & privacy
Privacy that happens before the model, not after.
PII is redacted upstream, the vault can live in the EU, and erasure means the data is gone — not flagged.
Redaction upstream
The model never reads a raw name.
Names, phone numbers, addresses, and card-shaped strings are pulled into a vault and replaced with tokens before any language model reads the text. Extraction runs on the redacted copy; the real values are rehydrated only into the record you own.
Four pillars
How your customers' data is protected.
Vault
Redaction before extraction. PII is tokenised into a keyed vault upstream of the model, then rehydrated only into your record — the language model only ever sees redacted text.
Moderation
Toxic content is screened both ways — what a respondent submits and what the form says back — so an intake never becomes a channel for abuse.
EU residency Landing
Pin the jurisdiction: keep the vault and its processing in the EU when residency is a requirement. This lane is rolling out now — ask us for early access.
Erasure
Deletion, not tombstoning. An erasure request removes the response and its vault entries — the data is gone, not flagged as hidden while it lingers in a table.
Residency & erasure
Where the data lives, and how it leaves.
Two questions a compliance team always asks first — and the honest answers, including what is shipped today and what is still rolling out.
Data residency
Pin the vault to an EU jurisdiction so PII is stored and processed inside the region. The jurisdiction-pinned lane is a locked architecture; the hosting for it is rolling out now.
Erasure
Erasure deletes the response record and its vault tokens together. There is no soft-delete tombstone left behind — when a record is erased, the underlying data is removed.
What's still landing
LandingThe edge failover lane and the regional PII sidecar (the EU residency posture) are rolling out now, not generally available. We label them plainly rather than sell them as shipped — if EU residency is a hard requirement, book a demo and we'll scope where the lane stands for your setup.
For compliance teams
Bring your security questionnaire.
We don't publish a compliance badge we haven't earned. If you need a data-processing agreement, a residency commitment, or a walkthrough of the redaction and erasure paths, the fastest route is a short call — we'll answer straight, including where a lane is still landing.
Book a demo