Security & compliance

Your data,
locked down.

It stays private, stays in the US, and never trains a model. You hold the keys - and can take it all back whenever you want.

Request the security brief ->See the controls

US data residency/No training on your data/NDA day one

01Where it lives

In the US.
Encrypted throughout.

US residency. Client data sits on US-based infrastructure.
Encrypted end to end. TLS 1.2+ in transit, AES-256 at rest.
Named providers only. The subprocessor list is shared on request under NDA.

02How it's guarded

Built to clear
a security review.

Access by matter

People see the matters they're on, not the whole firm.

Full audit trail

Every action logged - who did what, and when.

Zero training

Your work never trains a model. It's in the contract.

03Who's in charge

It's yours.
You keep control.

Bring it in, export it, or delete it on your schedule. When an engagement ends, your data leaves with you.

04Certifications

We report status.
We don't fake a badge.

SOC 2 Type IIIn progress. Scope and reports under NDA.

ISO 27001 / 42001In progress. Status shared honestly on request.

HIPAA / GDPRMapped to your obligations under NDA.

05FAQ

Common questions.

Answered plainly.

Something else? Ask us ->

Do you train on our data?

No - contractually, your data never trains any model.

Where is it stored?

On US-based infrastructure, encrypted in transit and at rest.

Can we get it out?

Any time. On exit it's returned or destroyed on your terms.

Are you certified?

SOC 2 and ISO are in progress; we walk your team through scope under NDA.

Get started

Hand it to your security team.

We bring subprocessors, data terms, and current status to the table.

Request the security brief ->See Goodman OS

US data residency / No training on your data / NDA day one

Your data,locked down.

In the US.Encrypted throughout.

Built to cleara security review.

It's yours.You keep control.

We report status.We don't fake a badge.