Built like
grown-up software.
Encryption everywhere it counts. Identity that maps to yours. An audit log that survives your auditor's questions.
Six categories. One picture.
Encryption
At rest (AES-256), in transit (TLS 1.3). Indexes, embeddings, backups — all encrypted.
Identity
OIDC, SAML, SCIM. RBAC by group. Per-document ACLs respected from your source systems.
Audit
Every read, every write, every prompt. Streamed to your SIEM. Append-only.
Data residency
Cloud regions in AU, EU and US. Sovereign deployments stay in-country, in-perimeter.
Compliance
APP 8, IRAP, CPS 230. SOC 2-aligned controls. Details on Sovereign.
Vulnerability disclosure
Coordinated disclosure with a public PGP key. 24-hour response. Researchers welcome.
Encryption & data handling.
-
At rest
All persisted data is encrypted. Indexes and embeddings included. Backups use separate keys.
-
In transit
Encrypted between every service hop. No unencrypted plane, anywhere — internal or external.
-
Key management
AWS KMS on Cloud, your KMS or HSM on Sovereign. Customer-managed keys supported on both tiers — you hold them, you revoke them.
-
Data minimisation
We index what you upload. Prompts aren't retained past the audit horizon. We never train models on customer data — full stop.
Identity & access.
-
Single sign-on
Tested with the providers your IT team already uses. No bespoke auth.
-
SCIM provisioning
Users and groups sync from your IdP. De-provisioning is automatic — leavers lose access the same day.
-
Role-based access
Permissions at the workspace, knowledge base, agent and chatbot level. Inherits into chat answers — Certant won't surface what the user couldn't read directly.
-
Per-document ACLs
Where your source system carries them, Certant respects them at query time. The bot can't cite what the user can't open.
Audit & monitoring.
-
Audit logs
Every auth, query, agent run, document ingest and config change — with actor, timestamp and payload digest.
-
Retention
Default on Cloud. Fully configurable on Sovereign — set it to your auditor's horizon.
-
Streaming
Logs stream to your existing forensics stack. No vendor lock — pick your destination.
-
Append-only
Historical entries cannot be modified once written. Tamper-evident by design.
Sub-processors.
We list every sub-processor that touches Cloud customer data. Sovereign deployments use zero sub-processors by design — your data never leaves your perimeter.
| Sub-processor | Purpose | Region |
|---|---|---|
| AWS | Compute, storage, KMS | AU · EU · US |
| OVH Cloud | Compute, storage | EU |
| Runpod | GPU compute (model inference) | EU · US |
| DeepInfra | GPU compute (model inference) | EU · US |
| Vercel | Marketing site & docs hosting only — no customer data | Global edge |
| Resend | Transactional email (sales / support) | EU |
| Stripe | Billing (Cloud) | Global |
Vulnerability disclosure.
-
Found something? Tell us.
Email [email protected] with a clear description and (if applicable) a reproduction.
-
We respond fast.
Acknowledgement within 24 hours. We don't pursue good-faith researchers.
-
Encrypt sensitive reports.
For high-severity issues, encrypt your report with our PGP key (below) before sending.
Bring your security review.
We answer the questionnaire. We share what we have. We don't make you sign an NDA to read this page.