Built for
privileged data.
From day one.
Multi-tenant isolation enforced at the data layer on every retrieval. Zero training on your documents, zero data retention on AI inference.
Zero data retention
AI inference, by policy
AES-256 at rest
AWS KMS key management
TLS 1.3 in transit
All endpoints
Zero training
On customer data, ever
Multi-tenant isolation
user_id AND case_id
Controls that earn
a place in your workflow.
Encryption, isolation, retention, and compliance — engineered for privileged data, not bolted on after the fact.
Encryption everywhere
AES-256 at rest with AWS KMS key management. TLS 1.3 in transit on all endpoints. Every blob, queue message, and database row is encrypted.
Multi-tenant isolation
Every retrieval filters by user_id AND case_id at the data layer. Matter A cannot leak into Matter B — partitioning is structural, not an application-level guard.
SOC 2 program underway
Our SOC 2 Type II readiness program covers the security, availability, and confidentiality trust service criteria. Documentation available on request.
Retention & deletion
Documents retained for the duration of the active case plus a 90-day grace period. Deletion on request, with audit-log confirmation.
E-discovery compliance
Bates numbering, custodian mapping, privilege review, and FRCP 26(b)(5) privilege logs — defensible production built into the workflow.
Zero training on your data
Your documents are never used to train any model. AWS Bedrock runs in zero-data-retention mode — prompts are never retained or used for training.
Filtered by user_id AND case_id. Always.
This is not an application-level guard — the partitioning is structural. A retrieval call that omits either key fails at the data layer before it reaches the language model. Matter A cannot leak into Matter B.
No cross-tenant leakage — enforced at every layer
What we certify
and commit to.
Every hop in the pipeline is queue-mediated and encrypted. No component has direct access to another tenant's data.
SOC 2 program
Our SOC 2 Type II readiness program is underway, covering the security, availability, and confidentiality trust service criteria. Current security documentation is available on request.
Request documentation →Sub-processors
AWS, Qdrant Cloud, Neo4j, Supabase. Full list published below. Each covered by a signed data processing agreement.
See the list →Data residency
All case data stored in AWS us-west-2 by default. Custom regions available on Enterprise plans. No cross-border transfer without explicit configuration.
See Enterprise →Retention
Documents retained for the duration of the active case plus a 90-day grace period. Deletion on request, with audit log confirmation.
Contact us →Who processes your data.
Each sub-processor is subject to a signed data processing agreement. This list is current as of June 2026 and will be updated on any material change.
Need our security overview, DPIA, or sub-processor list?
We respond to security inquiries within one business day. Email security@ananse.ai or use the contact form — we have a pre-built vendor risk assessment packet ready.