Trust Center
Auditable. Role-scoped. Region-flexible.
Customer-facing AI handles real conversations with real people. Compliance is not a feature added later. It is the floor we build on. Below is the full posture.
Encryption
TLS 1.2+ · AES-256
Data isolation
Per-tenant, never shared
Compliance
SOC 2 Type II · in progress
SOC 2 Type II
Audit in progress
GDPR
EU data compliance
DPDP Act
India DPDP compliance
TLS 1.2+ · AES-256
Encryption in transit + at rest
Six commitments, every tenant.
Honest about what is in place today, and what is on the roadmap. We publish what we have, not what we hope.
Tenant isolation
Every tenant's data is logically isolated at the database boundary. Customer conversations, leads, and configuration cannot leak across accounts. Verified at the API layer, not by convention.
Encryption
All data encrypted in transit (TLS 1.2+) and at rest (AES-256). Tenant-level secrets are encrypted with rotated keys. Per-environment key separation is enforced by design.
Audit trail
Every state-changing action is logged. Append-only, attributable, exportable. Mutations, role grants, credential rotations, PII redactions all recorded. The audit log is the source of truth.
Role-scoped access
Granular role-based access control. Admin, operator, read-only, custom roles. Enforced at the API boundary. SSO and SAML available on enterprise tier.
AI model safety
Model providers are tiered. We use the contractual tiers that exclude customer data from foundation-model training. If we add a provider without that guarantee, it appears here first.
Compliance roadmap
GDPR-ready export and deletion endpoints. DPA available. SOC 2 Type II audit in progress. ISO 27001 planned. Honest status above; we publish what we have, not what we hope.
100% of state-changing actions, recorded.
Append-only, attributable, exportable. The audit log is the source of truth, not a side channel. Every mutation, every role grant, every key rotation, every PII redaction.
Roles enforced at the API, not by convention.
Granular role-based access control with custom roles on enterprise tier. SSO and SAML supported. Nothing has wildcard access by default.
Data lives where you say it does.
Region-flexible at the storage boundary. Inference routing follows the tenant's residency policy. Enterprise plans get contractual residency guarantees with named regions.
Providers we may use, listed for the record.
Required disclosure under GDPR. Fairshift evaluates and swaps providers as the ecosystem evolves; this is the current set we may call on, not a fixed commitment. Last updated April 2026.
Provider
Role
Data handled
Region
Anthropic
Reasoning, drafting, multilingual handling
Conversation content, customer context
USA
OpenAI
Reasoning and drafting
Conversation content, customer context
USA
Reasoning and multimodal
Conversation content, multimedia
USA
Retell / Vapi
Voice rails (inbound + outbound calls)
Call audio, transcripts
USA
Anam AI
Video avatar rendering
Session audio, video frames
USA / EU
KIE.ai
Image and video generation
Asset prompts, generated media
USA
Apollo / Clay
Lead data enrichment
Company and contact data
USA
Smartlead / Instantly
Email warming
Sender-mailbox metadata
USA / EU
Lovable / v0
Landing page generation
Campaign briefs, generated pages
USA / EU
Gamma
Deck generation
Deck briefs, generated content
USA
Perplexity / Exa
Research
Research queries
USA
Amazon Web Services
Cloud hosting and compute
All customer data at rest and in transit
Multi-region (customer-configurable)
Vercel
Edge hosting for marketing and app
Static assets, session tokens
Multi-region
Supabase
Primary database and auth
Account and operational data
Multi-region
Twilio
SMS delivery, phone numbers
Message content, phone metadata
Multi-region
Meta (WhatsApp Business)
WhatsApp message delivery
Message content, phone numbers
Multi-region
Stripe
Billing and payment processing
Billing info, payment methods
USA / EU
Audits, DPAs, security reviews.
We walk security teams through architecture, share DPAs, and answer compliance questions in writing. Reach the team directly.