Security you can check, not just trust.
Compliance status
Updated October 2026- SOC 2 Type IISecurity, Availability and Confidentiality. Observation period started 1 October 2026.Audit in progress
- HIPAABusiness Associate Agreements for Enterprise customers, after a review of how you'll use eesel with health information.Available
- Security policies18 written policies, version 1.4, approved by leadership and reviewed every year.Adopted
- Data Processing AgreementA DPA covering GDPR, with Standard Contractual Clauses for international transfers.Available
- Daily control checks50 controls, checked by code every morning and recorded as audit evidence.Running
On the road to SOC 2 Type II
- September 2026
Program built
50 controls mapped to every SOC 2 criterion in scope, each with an owner and a defined piece of evidence.
- October 2026
Policies adopted
18 security policies approved by leadership, covering everything from access control to AI governance.
- 1 Oct to 31 Dec 2026We are here
Observation period
Every control runs and is evidenced daily. This is the period the auditor tests.
- Early 2027
Independent audit
An independent auditor tests our controls against the evidence from the observation period.
- 2027
Report available
Customers and prospects can read the full SOC 2 Type II report under NDA.
A compliance program written as code
We didn't buy a compliance dashboard. Our controls, policies and evidence collectors live in our own codebase, change only through reviewed pull requests, and run every morning. When a check fails, an engineer hears about it that day, not at audit time.
- security controls
- 50
- written policies
- 18
- automated evidence checks
- Daily
- breach notification commitment
- 48h
How we protect your data
Encryption
- Our public endpoints accept only TLS 1.2 or higher.
- Production databases and their backups encrypted at rest with AES-256.
- File storage and message queues encrypted at rest.
- Encryption keys managed in AWS KMS and rotated every year.
Access control
- Least-privilege access for staff, approved before it is granted.
- Access reviewed every quarter and removed within 72 hours when someone leaves.
- Staff access to production data is read-only by default.
- Two-factor authentication required across our source code organization.
Secure development
- Every change goes through a pull request with required build, test and secret-scanning checks.
- Changes to infrastructure, authentication, billing and permissions need a founder's approval.
- Every code push is scanned for leaked secrets.
- Dependencies are monitored for known vulnerabilities, with fix deadlines by severity.
Infrastructure
- Hosted on Amazon Web Services.
- All infrastructure defined as code. Every change is planned, reviewed and approved before it is applied.
- Production deploys are started by a named person from reviewed code, and every deploy is recorded.
- AWS threat detection (GuardDuty) and security benchmarks (Security Hub) enabled in every region.
Monitoring and logging
- Production is monitored around the clock, and alerts page an on-call engineer.
- Cloud account activity logged in every region, with tamper-evident log files kept in write-protected storage for a year.
- Service logs kept for at least one year.
- Public status page at status.eesel.ai.
Incident response
- A written incident response plan covering triage, containment, root cause and fixes.
- If a breach affects your data, we tell you within 48 hours of becoming aware of it.
- Service incidents posted publicly on our status page.
People
- Everyone with access to customer data signs confidentiality terms.
- New hires are screened before they start.
- Security training is required when people join and every year after.
- Work devices must have disk encryption, automatic updates, a firewall and screen lock.
Vendor management
- A register of every vendor that handles customer data, with an owner for each.
- Each vendor's security reviewed every year.
- A published list of our subprocessors, below.
Your data runs your agents. Nothing else.
Never used for training
eesel does not train or fine-tune models on your data. AI providers process it only to generate your agent's responses, under commercial API terms that do not permit training on API data.
Isolated per workspace
Each workspace's data is kept separate. An agent can only search the knowledge you've given it, and automated tests check that boundary on every code change.
Only the actions you allow
Agents can only use the tools you turn on. Any action can be set to wait for a person's approval, and outbound requests are limited to domains you allow.
Credentials stay out of the AI
When you connect an app, the key goes straight to our servers through a secure form. The AI model never sees your passwords or API keys.
Optional PII redaction
Turn on redaction to strip personal details such as emails, phone numbers and card numbers from synced helpdesk tickets before they are stored and indexed.
Every run on the record
Every conversation and action your agents take is logged in your workspace's activity view, so you can see exactly what happened and why.
Where your data lives, and how it leaves
Hosting
Production runs on AWS in the United States (N. Virginia). Full EU data residency is available on the Enterprise plan.
Backups
Databases are backed up automatically every day and backups are kept for 35 days, encrypted. File storage is versioned.
Recovery
Our recovery targets are 4 hours to restore service and no more than 24 hours of data loss. Restore testing is part of our SOC 2 controls.
Deletion
Delete your workspace and its documents, search index, integrations, credentials, agents and conversation history are wiped from our live systems straight away. Encrypted backups roll off within 35 days, and security logs expire on a fixed schedule.
Who helps us run eesel
| Subprocessor | What it does |
|---|---|
| Amazon Web Services | Cloud hosting, databases and file storage |
| Anthropic | AI models |
| Baseten | Runs open AI models such as DeepSeek, with zero data retention |
| DeepInfra | Runs open AI models such as DeepSeek, with zero data retention |
| Firecrawl | Reading websites you add as knowledge |
| Fireworks AI | Runs open AI models such as DeepSeek, with zero data retention |
| AI models, including removing personal details from text | |
| Intercom | eesel's own customer support inbox |
| Microsoft Azure | Runs DeepSeek models that score finished conversations |
| OpenAI | AI models |
| Pinecone | Search index of the knowledge you connect |
| Pipedream | Connections to the apps you choose to connect |
| PostHog | Product analytics, and session replay of the dashboard with all text and typing masked |
| SendGrid (Twilio) | Sending and receiving email |
| Slack | eesel's own team workspace, for internal alerts and support |
| Together AI | Runs open AI models such as DeepSeek, with zero data retention |
| Typesafe AI | Checks an action an agent is about to take against what it was asked to do |
| Vercel | Hosts the dashboard and the sandboxes where agents run |
| Vercel (AI Gateway) | Routes requests to the AI model providers on this list |
| Auth0 (Okta) | Sign-in to the dashboard |
| Datadog | Monitoring and logs |
| Google Analytics | Website and dashboard analytics |
| Stripe | Payments |
Apps you connect yourself, such as Zendesk, Shopify or Slack, are not subprocessors. They are systems you chose, and eesel reads from and writes to them on your instruction. See the full list, with locations and a feed of changes
Everything your security review needs
SOC 2 Type II report
After auditAvailable under NDA once the audit is complete. Ask us for a status update in the meantime.
Security policy pack
Under NDAAll 18 of our security policies in one document.
Data Processing Agreement
On requestOur DPA, including Standard Contractual Clauses.
Security questionnaires
On requestSend us your questionnaire (CAIQ, SIG Lite or your own) and we'll fill it in.
Mutual NDA
On requestOur standard mutual NDA, or we'll sign yours.
security.txt
PublicOur machine-readable security contact, published to the RFC 9116 standard.
Found a vulnerability? Tell us.
Email engineering@eesel.app with the details and how to reproduce it. We acknowledge credible reports within one business day and keep you updated until it's fixed. Please give us a reasonable chance to fix the issue before you share it, and don't access other customers' data or disrupt the service while testing.
engineering@eesel.appSecurity FAQ
Our SOC 2 Type II audit is in progress. The observation period runs from 1 October to 31 December 2026 and covers Security, Availability and Confidentiality. The independent audit follows in early 2027, and the report will be available under NDA once it's issued. We're happy to walk you through our controls in the meantime.
Yes. We sign Business Associate Agreements with Enterprise customers, after a review of how you'll use eesel with health information. Talk to us before you connect any protected health information so we can set up your workspace correctly.
No. eesel never trains or fine-tunes models on your data. AI providers process it only to generate your agent's responses, under API terms that exclude training.
eesel uses models from leading providers, including Anthropic, OpenAI and Google, through their commercial APIs.
On AWS in the United States (N. Virginia).
Yes. Our public endpoints accept only TLS 1.2 or higher. Our databases, their backups, file storage and message queues are encrypted at rest with AES-256, using keys managed in AWS KMS.
Yes. Deleting your workspace wipes its documents, search index, integrations, credentials, agents and conversation history from our live systems straight away. Encrypted backups roll off within 35 days, and security logs expire on a fixed schedule. You can also ask us to delete your data and we'll confirm when it's done.
Within 48 hours of becoming aware of a breach that affects your data. Service incidents are posted on status.eesel.ai.
Yes. We offer a DPA with Standard Contractual Clauses for international data transfers. Email us and we'll send it.
Yes. Send it to engineering@eesel.app and we'll work through it with you.
Running a security review?
Talk to the people who run our security program. We'll send our security pack, answer your questionnaire and get on a call with your security team.