Security & Data Privacy
Our commitment to protecting your data and respecting your privacy.
Overview
At Alkimi AI, we are deeply committed to the security of our platform and the protection of your data. We understand that trust is paramount, especially for enterprise and educational institutions. This document outlines the comprehensive security measures and data privacy practices we have implemented to safeguard your information.
Data Security
We employ a multi-layered approach to data security, ensuring your information is protected at every stage.
Data Encryption
- In Transit: All data transmitted between your browser and our services is encrypted in transit using industry-standard TLS 1.2 or higher, enforced by our partners at Google Cloud and Cloudflare.
- At Rest: All your data, including knowledge base content, agent configurations, and chat histories, is encrypted at rest using the built-in AES-256 encryption capabilities of our database provider, Google Cloud SQL.
Data Storage & Isolation
We utilize a multi-tenant architecture with strict logical data isolation. Your organization's data is segregated from other customers' data at the database level using PostgreSQL's Row-Level Security (RLS). This ensures that a given user, connected through a properly authenticated database connection, can only access the data that pertains to their organization.
Furthermore, we employ PII (Personally Identifiable Information) anonymization techniques within our database for sensitive data fields, providing an additional layer of privacy protection.
Network Security
Our infrastructure is hosted within a Google Cloud Virtual Private Cloud (VPC). We utilize carefully configured firewalls and network access control lists to block unauthorized access, and our databases are not exposed to the public internet, only accessible by authenticated services within our secure environment.
Data Centers & Physical Security
Our services are hosted on Google Cloud Platform and Cloudflare, which maintain state-of-the-art data centers with robust physical security controls, including 24/7 monitoring, biometric access, and redundant power and cooling.
Monitoring & Logging
Our major cloud and database services are configured with comprehensive audit logging enabled. We log network traffic, administrative access, and database activity to provide a detailed audit trail for security monitoring and incident response.
Business Continuity & Disaster Recovery
We maintain a comprehensive backup and disaster recovery strategy to ensure business continuity. Our database is automatically backed up daily, with backups retained for 30 days. These backups are encrypted and stored in a separate region to ensure data durability even in the event of a catastrophic regional failure. We test our restoration procedures to ensure rapid recovery capabilities on an annual basis.
Application Security
Security is an integral part of our development process, from design to deployment.
1. Design & Planning
Threat Modeling & Security Requirements Analysis for all new features.
2. Development
Automated Code Scanning (SAST), Dependency Analysis (SCA) & Secure Coding Standards.
3. Testing & QA
Mandatory Peer Reviews, Security Unit Tests & Secrets Scanning in CI/CD pipeline.
4. Deployment
Continuous Monitoring, Automated Dependency Updates & Responsible Disclosure Program.
Secure Development (SSDLC)
We are committed to building secure software. Our development process includes automated static code analysis, dependency vulnerability scanning, and AI-assisted code review on all pull requests to identify and remediate potential vulnerabilities early in the development lifecycle.
Vulnerability Management
We use continuous, automated vulnerability scanning to monitor our applications and infrastructure for emerging threats. We strive to address identified vulnerabilities promptly based on their severity and impact.
We engage an independent third-party security firm to conduct annual penetration testing of our production environment, covering the web application, API endpoints, and edge configuration. Testing follows OWASP methodology, and findings are severity-ranked and tracked to resolution.
API Security
Our API endpoints are protected by a robust security layer that includes strict authentication and rate limiting.
- Authentication: Access is governed by user-scoped and role-scoped tokens, ensuring that API clients can only perform actions permitted by their specific permissions.
- Rate Limiting: To prevent abuse and ensure availability, we enforce dynamic rate limits on all endpoints. Resource-intensive operations are further throttled based on organization credit availability.
Access Control
Access to data within the Alkimi platform is governed by a robust Role-Based Access Control (RBAC) system that employs a "defense-in-depth" strategy, using both the application middleware and the database to enforce permissions.
User Initiates Request
Middleware RBAC Check
Validates session and ensures user has the correct role for the endpoint.
Database RLS Enforcement
Policies filter data rows based on the secure session context.
Access Granted
Only if both checks pass
Access Denied
If either check fails
This layered approach ensures that even if a flaw were to exist in the application logic, the database's own security rules (Row-Level Security) would act as a final, authoritative backstop, preventing any unauthorized data access. The application middleware performs initial role-based checks and prepares a secure, context-aware database connection, but the database policies have the ultimate say on what data is visible. For a detailed breakdown of the default roles and their specific permissions, please see our Help & Guides.
Conversation Sharing
The platform provides features for users to share their conversations via secure, unguessable links. This form of access is also governed by strict controls:
- User-Initiated: Sharing is always initiated by the user, who has full control over whether to make a conversation accessible to others.
- Visibility Controls: Users can choose between two visibility levels for each shared link:
- Organization: The link is only accessible to other authenticated members of the user's organization.
- External: The link is accessible to anyone who has it.
- PII Redaction: To further protect privacy and prevent accidental data exposure, the platform includes a PII (Personally Identifiable Information) detection and redaction feature, which is enabled by default on all shared chats.
- Revocation of Access: Users retain full control and can revoke access to any shared conversation at any time by deleting the share link from their account settings.
Authentication
We support strong authentication measures, including Single Sign-On (SSO) with providers like Google and Microsoft, to ensure secure and convenient access to your account. For accounts using password-based authentication, we enforce password complexity requirements.
We offer native Multi-Factor Authentication (MFA) for all accounts, with support for TOTP authenticator apps (such as Google Authenticator or Authy), hardware security keys and passkeys (FIDO2/WebAuthn), email verification codes, and backup codes. Organizations can enforce MFA for all members through admin policies, and sensitive operations require re-authentication (sudo mode).
Compliance
Visit our Trust Center
Request the third-party FERPA attestation and SOC 2 Type 1 report, review policies and subprocessors, or submit a security questionnaire.
Prefer to talk it through? Contact us.
For Higher Education (FERPA)
Our Commitment to Student Privacy
Alkimi AI has completed a third-party FERPA attestation, and higher education institutions can engage us as a service provider under FERPA's school official exception.
Handling Student Data
When a higher education institution uses Alkimi AI, we understand that the institution acts as the custodian of student education records, while students (who are typically adults) retain their rights under FERPA. We act as a service provider and process data only on behalf of and at the direction of the institution.
- Data Custodianship: The higher education institution acts as the custodian of student education records uploaded to the Alkimi platform, while students retain their FERPA rights to access, review, and control disclosure of their information. Our role is that of a data processor working under the institution's direction.
- Account Data: We collect the account identity needed to provide the service: email, first and last name, and an optional profile picture. Users may also provide Customer Content in chats and uploads; technical, cookie, and usage data are described in the Privacy Policy.
- Data Use: We will not use student data for any purpose other than providing and improving our services as directed by the institution. We do not use student data for advertising or marketing. The only time PII is shared with a third party is when it is necessary for a model provider to process a request (e.g., to address a user by name in a response), and we maintain appropriate data processing agreements with those providers to protect this information.
Data Privacy
Privacy Policy
Our Privacy Policy provides detailed information about the data we collect, how we use it, and your rights regarding your data. We are committed to transparency and empowering you to control your information.
How Customer Content Is Processed
Customer content travels over encrypted transport to Alkimi for storage and inference. Requests sent to model providers are configured so customer content is not used for model training.
Course content & chat
Materials and conversations users choose to provide
Alkimi secure workspace
Controlled boundary for storage and processing
Encrypted storage
AES-256
Model provider
Processes requests for inference; not used for training
Data Handling at a Glance
A concise view of the data needed to provide the service and the controls applied to it.
Data used to provide the service
- Account identity
- Chats and uploaded materials users choose to provide
- Service and security logs
How it is handled
- Encrypted storage
- Model providers process requests under configured no-training terms
- Stripe handles payment-card data
- Sharing and deletion controls
Data Retention & Deletion
You have control over your data. You can delete your knowledge collections, agents, and account at any time. Knowledge collections are removed from active production use when deleted. Customer data, including agent configurations, conversation history, and account data, is retained for the duration of an active subscription and deleted within ninety (90) days following subscription termination, or sooner upon request. Backup copies age out within this documented ninety (90)-day deletion window. Upon completion of a deletion request, written confirmation is provided within ten (10) business days.
For conversations that do not need to be retained, we offer a Temporary Chat feature. Content from these chats is designed to be ephemeral and is not persisted to long-term storage, offering a higher level of privacy for sensitive discussions.
AI Model Security & Subprocessors
We partner with industry-leading AI model providers to power our platform. We understand the critical importance of protecting your intellectual property and data from being used to train third-party models.
- No Training on Customer Data: We explicitly configure our integrations with model providers to opt-out of data training. Your data is processed solely for the purpose of generating a response and is not used to improve their foundation models.
- Subprocessors: We currently utilize the following providers for AI inference and billing. We maintain appropriate Data Processing Agreements (DPAs) with these partners.
- Anthropic, Google, OpenAI, xAI: Foundation model providers.
- OpenRouter: Unified interface for accessing various open-source and proprietary models.
- Stripe: PCI DSS Level 1 compliant payment processor for all billing operations.
Responsible Disclosure
Found a security vulnerability in our platform? Email security@alkimi.ai with a description of the issue, reproduction steps, and the affected endpoint or component. This policy covers the Alkimi AI Platform, including our web application, API endpoints, and edge configuration; customer-controlled environments, third-party services, and social engineering are out of scope.
What you can expect from us:
- Response: We will acknowledge your report within 5 business days and provide a severity-ranked remediation timeline within 15 business days.
- Remediation: Fixes are prioritized by severity and impact, and timelines vary with complexity. We will keep you informed of progress until resolution.
- Recognition: We do not currently offer a bug bounty program. With your permission, we are glad to publicly credit researchers who report valid issues.
What we ask of researchers:
- Coordinated Disclosure: Observe the widely adopted 90-day coordinated disclosure window before any public disclosure, giving us a reasonable opportunity to remediate. We are happy to coordinate on timing once a fix is in place.
- Good Faith: Avoid privacy violations, data destruction, and service disruption, and only interact with accounts you own or have permission to access. Reporting a vulnerability does not create an entitlement to compensation, and reports should not be made conditional on payment.
Safe Harbor: We will not pursue legal action against researchers who report in good faith and follow the guidelines above.
Further Questions?
We understand that enterprise and educational customers may have detailed security and compliance questionnaires. If you have any further questions, please don't hesitate to reach out to our team.