Your team’s thinking,
protected.

The work your team does in Convaa is sensitive. We protect it with the controls security teams expect — and we never train on your data.

SOC 2 Type II GDPR CCPA ISO 27001

Never trained on your data

Your prompts, attachments, and team knowledge are never used to train models — ours or anyone else’s. Your thinking stays yours.

Encrypted everywhere

TLS 1.2+ in transit and AES-256 at rest, on every session. Secrets are managed in a hardened KMS, with keys rotated regularly.

You own and control it

Export or delete your data anytime. Role-based access, least-privilege internally, and full audit trails on Enterprise.

Controls

The controls your security team asks for.

SOC 2 Type II

Independently audited controls for security & availability.

SSO, SAML & SCIM

One-click sign-in and automated provisioning for your org.

Encrypted end to end

TLS in transit, AES-256 at rest, on every session.

Audit logs & retention

Full activity history with configurable retention windows.

Data residency

Choose where your workspace data lives, on Enterprise.

Least-privilege access

Internal access is scoped, logged, and reviewed regularly.

Data handling

How we handle your data.

Is our data used to train models?

No — never. Your prompts, files, and team knowledge are used only to power your sessions. They are not used to train any model, and they are not shared with other customers.

Where is our data stored?

Data is stored with leading cloud providers in encrypted, access-controlled environments. Enterprise customers can select a specific region for data residency.

Who on your team can access it?

Access is least-privilege and logged. Only a small, audited set of staff can access production systems, and only when required for support or reliability — never to read your content casually.

How do deletion and retention work?

You can delete sessions or your whole workspace at any time; deletions propagate to backups on a fixed schedule. Enterprise plans add configurable retention windows.

Found a vulnerability?

We welcome responsible disclosure. Reach our security team and we’ll respond quickly.

[email protected]