Trust
A trust product has to earn trust first.
This page documents how Attestloom handles your evidence, who processes it, how long we keep it, and what we will never do with it. It also says plainly what we do not have yet.
The never-invents stance
No source, no answer.
Attestloom never states a control, certification, or capability that your own documents do not show. Every drafted answer must cite a verbatim passage. If a question names a framework no source mentions, or the evidence covers too little of it, the answer is left as Needs owner with the reason, and a person decides.
Q-174Do you hold a FedRAMP authorization?
Needs ownerNo source mentions FedRAMP. Attestloom does not state certifications, authorizations, or coverage that your evidence does not show.
Guardrails on every answer
- Citations verified as exact spans of your documents
- Confidence capped by evidence coverage
- Under 0.80 confidence: reviewer approval before export
- Every export ships with an audit log of approvals
- Model replies rejected unless they validate against a schema
Data handling
Encrypted at rest and in transit
The database runs on encrypted storage at our host. Original uploaded files are additionally sealed with AES-256-GCM using a per-workspace key derived with HKDF-SHA256. All traffic uses TLS 1.2 or higher.
Tenant isolation
Every customer row carries a workspace ID, and every query filters on it after a server-side membership and role check. There is no shared index across workspaces.
Never used to train models
We do not train or fine-tune models on customer content. Providers receive only the question and retrieved passages for one request, through API terms that exclude training, with storage disabled where the provider supports it.
Retention you control
Sources stay until you delete them. Deleting a source removes its passages and embeddings immediately. Deleting a workspace removes all of its data immediately; host backups expire within 30 days.
Deletable and exportable
Owners can export everything as JSON plus original files, and delete the entire workspace, from Settings. No ticket required.
Public demo stores nothing
The homepage demo answers against fictional sample documents in memory. Questions you paste are not logged or kept.
Subprocessors
| Subprocessor | Purpose | Location | Data involved |
|---|---|---|---|
| OpenAI, L.L.C. | Language model inference and embeddings for drafting and retrieval | United States | Question text and retrieved source passages for the request in flight. API data is not used for training; requests are sent with storage disabled. |
| Vercel Inc. | Application hosting, edge network, and serverless functions | United States (iad1) | Request metadata and transient processing of uploads |
| Neon Inc. | Managed PostgreSQL with pgvector (primary database) | United States (AWS us-east-1) | Account data, source chunks, embeddings, questionnaires, answers, audit log |
| Stripe, Inc. | Subscription billing | United States | Billing contact and payment method, held by Stripe; Attestloom never sees full card numbers |
| Resend, Inc. | Transactional email (verification, password reset, assignment notices) | United States | Recipient email address and message content |
We give customers 30 days notice before adding a subprocessor that processes customer content. Customers on Enterprise terms can restrict model routing to a single provider.
Compliance roadmap
What we do not have yet, labeled as such.
Attestloom does not currently hold a SOC 2 report or an ISO certification. These items are in progress or planned; none is complete.
- Penetration test by an independent firmRoadmap · Scheduled for Q1 2027
- SOC 2 Type I examinationRoadmap · In progress, not yet issued
- SOC 2 Type II observation periodRoadmap · Planned after Type I
Responsible disclosure
Found something? Tell us first.
Email security@attestloom.com with steps to reproduce. We acknowledge within two business days, keep you updated, and will not pursue good-faith research that avoids privacy violations, data destruction, and service disruption.
Attestloom Inc., Attn: Security1910 Pacific Avenue, Suite 1450, Dallas, TX 75201
(214) 555-0147