Security overview
This page applies to every product built by Carnegie Intelligent Technology Limited. Product-specific details (what data a product stores, for how long) are on each product's site and in the DPA.
Last updated 20 October 2026 · Questions: [email protected]
Hosting and architecture
All products run on Google Cloud (asia-east1 by default; EU and US regions on request). Each product is a separate Google Cloud project with its own service accounts, secrets and quotas. Customer data is tenant-isolated at the database row level and in object storage by tenant prefix; no customer can address another customer's data through any API.
Compute
Cloud Run services and jobs, scaled to zero when idle; no long-lived servers to patch.
Storage
Cloud SQL (PostgreSQL) with automated backups and point-in-time recovery; Cloud Storage for documents with lifecycle deletion.
Encryption
TLS 1.2+ in transit; Google-managed encryption at rest for databases, storage and backups.
Secrets
Only in Secret Manager; rotated without code changes; never in images or environment files.
Models and AI processing
By default inference runs on Google Vertex AI through our channel; customers may bring their own key for Anthropic, OpenAI or Google. Prompts and documents are sent to the model provider only for the request in hand and are not used by us or — under the providers' enterprise terms we use — by them to train models. Model usage is metered separately and itemised with request ids.
Access
Customer workspaces authenticate with Google or Microsoft SSO (OIDC) where offered, otherwise email magic links; no passwords are stored. Roles are scoped per workspace. Our own operational access is limited to named staff, uses Google Cloud IAM with short-lived credentials, and is logged in Cloud Audit Logs retained for two years.
Retention and deletion
Each product states its default retention for customer documents (typically 90–365 days) and lets the customer shorten or extend it. Deletion requests are executed within 30 days and backups roll off within 35 days. Billing records are kept for 7 years as required by Hong Kong law.
Audit trail
Every metered unit and every document action carries a request id and actor; exports available on request.
Data residency
Region selected per workspace; cross-region transfers only to the model provider you chose.
Availability
Target 99.5% monthly for annual plans; status and incident history published on request.
Vulnerability disclosure
Report to [email protected]. We acknowledge within 2 business days and do not pursue good-faith researchers.
Compliance posture
| Item | Status | Note |
|---|---|---|
| Data Processing Addendum (GDPR / UK GDPR / PDPO) | Available | Standard DPA with SCCs incorporated |
| Sub-processor list | Published | /legal/subprocessors |
| Hong Kong PDPO | Compliant | Data user: Carnegie Intelligent Technology Limited |
| Penetration test | Planned Q1 2027 | Third-party; summary under NDA |
| SOC 2 Type I | Planned H1 2027 | Type II after observation period |
Security questionnaires: send them to [email protected]. We answer in writing, usually within a week, and say plainly where we fall short.