SOC 2Type II Certified
CIHECO has completed an independent SOC 2 Type II audit of the platform. The report is available to qualified customers and prospects under NDA — request a copy at [email protected].
CSA STARLevel 1 Certified · Official Badge
CIHECO is listed in the CSA STAR registry at Level 1 (self-assessment) under Devora Tech LLC, submitted against the Cloud Controls Matrix.
Infrastructure Security
- Encryption: TLS 1.3 for all data in transit; AES-256 for data at rest, including backups.
- Tenant isolation: every workspace has its own knowledge-base index, conversation store and credential vault. No cross-tenant data path exists at any layer.
- Key management: API keys are stored hashed, rotated on request, and rate-limited per workspace.
- Least privilege: internal access requires SSO + MFA and is limited to on-call engineers for production systems.
Data Governance
- No training on partner data — your conversations and documents never train foundation models, ours or anyone else's.
- Retention: transcripts and knowledge bases are deleted 30 days after engagement termination.
- Subprocessors: model providers (OpenAI, Anthropic, Google, Meta) under enterprise data-protection terms; a full subprocessor list is available in our DPA.
Resilience
Multi-region inference with health-checked provider failover, automated encrypted backups, and a 99.9% uptime SLA (99.99% for Enterprise). Provider incidents degrade gracefully to fallback models without changing the API contract.
Responsible Disclosure
Found a security issue? Email [email protected] with details. We acknowledge reports within 2 business days and do not pursue legal action against good-faith research.