Security
Built to pass your security review.
Aimdoc acts inside your product on behalf of your customers. We treat that accordingly: SOC 2 Type II certified, GDPR compliance in practice, and transparent about our controls.
SOC 2
Type II certified
GDPR
DPA and data subject rights
TLS 1.2+
Encryption in transit and at rest
Trust Center
Policies, reports, and FAQs
// Agent controls
Work done for your customers
needs guardrails built in.
Every action runs as a verified user, through tools you granted, inside a budget you set, and lands in the audit log.
Verified identity
Your server signs who the user is. The agent acts only as that verified user, never as a shared admin.
Scoped tool grants
You choose which of your product's tools the agent and each service may call.
Sensitive-field redaction
Mark fields as sensitive and their values never reach the model or the logs.
Inspectable context
See the exact context the model saw on every turn, and every tool call it made.
Budgets and a kill switch
Prepaid credit caps, per-service limits, and the ability to stop any service instantly.
Human takeover
Escalations go to your team in Slack, and a rep can step into any conversation.
// Program overview
Organizational, technical,
and operational controls.
Our security program is aligned to SOC 2 and GDPR, and we continuously improve our controls as we scale.
People
Security training and background checks for employees.
Access control
Least-privilege access and role-based authorization.
Change management
Peer review and change management for production changes.
Vulnerability management
Continuous vulnerability management and regular dependency updates.
Continuity and response
Business continuity and incident response procedures.
// Data protection
How we handle
your data.
Encryption everywhere
TLS 1.2+ in transit, modern ciphers at rest.
Isolated infrastructure
Segregated production environment and secure secrets management.
Backups you can trust
Retention policies and regular restore testing.
Audit logging
Monitoring and audit logs on critical systems.
Your data, your call
Data minimization by default and customer data deletion upon request.
// Compliance
Compliance,
documented.
We maintain SOC 2 Type II certification and support GDPR compliance, including data processing agreements, data subject access requests, and international transfer mechanisms where applicable. Policies, reports, and FAQs are available in our Trust Center.