Security and data

Built for teams whose job is to say no.

Compliance functions are paid to be sceptical. The platform is designed to answer their questionnaire before it asks for their trust.

EU region, encryption at rest, TLS in transit. Object storage for Exhibit artefacts in-region.

Single-tenant workspace per customer. Managed auth, MFA for operators, least-privilege production access.

Agent outputs are stored for the run, used only to grade and produce the Exhibit. Never used to train anything.

Fictional persons and outlets. No personal data in the reusable library. Your private cases stay yours.

Append-only record of runs and edits so an Exhibit can be traced back to its inputs.

Default retention after the Exhibit unless extended. Deletion on request. Sub-processor list available on request.

We do not certify compliance and we are not a notified body or AI Act conformity assessor. Every Exhibit states its scope and limitations.

For a security questionnaire, DPA discussion or sub-processor list, email info@prevailing.ai.