Your contracts stay yours. Nothing leaves without your permission.
TAbot is built for enterprise technical accounting teams handling sensitive financial agreements. Security isn't a feature; it's the foundation every product decision is made on top of.
TAbot is SOC 2 Type 2 Certified
Independently audited and certified across Security, Availability, Confidentiality, and Processing Integrity. Our report is available to enterprise prospects under NDA.
How we handle your data with AI
ImportantNo model training on your data
Your contracts and documents are never used to train AI models (ours or anyone else's). This is contractually enforced through Data Processing Agreements with all model providers.
No cross-customer data exposure
Customer data is fully isolated. Your contracts cannot be seen by another TAbot customer, and vice versa. Tenant isolation is enforced at the infrastructure level.
Human-in-the-loop by design
TAbot never takes autonomous action on financial data. Every output is reviewed by your team before use. AI assists; your accountants decide.
Data retention controls
You control how long documents are retained within the platform. Data deletion requests are honored within defined SLAs, with audit trail confirmation.
Minimal data footprint
Only the data necessary to complete your analysis is passed to AI inference. We do not store raw model inputs or outputs beyond what is required for your workflow and audit trail.
Prompt & context isolation
Each analysis runs in an isolated inference context. Your contract data is never pooled with other customers' inputs, and no prior customer session can influence your results.
Infrastructure
Built on AWS. Secure by architecture.
TAbot runs on Amazon Web Services in the US, with security controls layered from the network up. We don't share compute or storage across customers.
Encryption at rest
All data stored in TAbot is encrypted using AES-256. Encryption keys are managed through AWS KMS with automatic rotation.
AES-256 · AWS KMSEncryption in transit
All data transmitted to and from TAbot is encrypted with TLS 1.2 or higher. Unencrypted connections are rejected at the network layer.
TLS 1.2+ · HTTPS enforcedAWS-hosted infrastructure
TAbot runs on AWS EC2 in US regions. AWS maintains SOC 1/2/3, ISO 27001, and FedRAMP certifications at the data center level.
AWS EC2 · United StatesBackup & recovery
Customer data is backed up automatically on a defined schedule. Restoration is tested regularly as part of our SOC 2 control framework.
Automated backups · Tested restoresNetwork isolation
TAbot services run in isolated network environments with strict ingress and egress rules. Internal services are not exposed to the public internet.
VPC · Security groupsContinuous monitoring
Infrastructure and application logs are monitored continuously. Anomalous access patterns trigger automated alerts to our security team.
CloudWatch · AlertingAccess & Identity
You control who sees what.
Access to TAbot and your data is controlled at multiple layers: from employee access inside TAbot to end-user access within your team.
Enterprise SSO
TAbot supports SAML and OIDC-based Single Sign-On via Firebase Auth. Authenticate through your existing identity provider: Okta, Azure AD, Google Workspace, and others.
Least-privilege access
TAbot team members are granted only the minimum permissions required for their role. Access to production systems is scoped, documented, and subject to regular review.
MFA enforced
Multi-factor authentication is required for all internal systems, cloud infrastructure, and administrative tools. There are no exceptions for privileged accounts.
Audit logging
All user actions (document uploads, queries, exports, and admin changes) are logged with timestamps and user context. Logs are tamper-resistant and retained for compliance review.
Access justification & review
Any TAbot employee accessing production customer data must provide documented justification. Access is time-limited and reviewed on a recurring basis.
Offboarding & revocation
When team members leave or change roles, access is revoked immediately across all systems. Offboarding is tracked as a formal checklist under our SOC 2 controls.
Application Security
Tested. Verified. Kept current.
We apply security rigor to the product itself, not just the infrastructure underneath it.
Privacy
Designed for the regulations your customers live under.
TAbot's privacy practices are designed in alignment with GDPR, CCPA, and applicable US data privacy laws. We are not a data broker and do not sell or share personal data for commercial purposes.
Data Processing Agreements
Enterprise customers can execute a DPA with TAbot, covering data processing roles, retention, and deletion obligations.
No data selling
TAbot does not sell, rent, or share customer data with third parties for advertising, enrichment, or any commercial purpose.
Sub-processor transparency
We maintain a list of infrastructure and AI sub-processors. Customers are notified of material changes before they take effect.
Right to deletion
Customers may request deletion of their data at any time. Deletion is confirmed in writing and completed within documented timelines.
Operational Security
Security as a company-wide practice at TAbot.
Questions about security or compliance?
Our SOC 2 Type 2 report is available to qualified prospects under NDA. Security questionnaires are welcome.
security@jointabot.com