Trust & Security
Your data is your business. We protect it with strict account isolation, AES-256 encryption, and access controls you control — stated plainly, the way we'd want a vendor to state it to us.
Core security pillars
Encryption
Sensitive data is encrypted at rest (AES-256) in the database and in file storage, and encrypted in transit (TLS) everywhere between your browser, our servers, and our AI infrastructure.
Seller isolation
Every account is fully isolated. Nothing is ever pooled, benchmarked, or compared across sellers — every query, report, and AI request is scoped strictly to your own account.
Decrypt-on-demand
Data is only decrypted in the application layer, at the moment a specific request is built — never cached or stored decrypted. Role and permission checks happen before decryption, so a blocked user's request never reaches that step.
AI request boundary
The GPU worker that powers Chat never touches the database or encrypted storage directly. It receives only the decrypted, request-scoped payload for that one request, in memory, and does not persist it afterward.
Access control
Passwordless sign-in
Sign in with Passkeys or a one-time email code — no shared staff passwords sitting in a spreadsheet or a sticky note.
Role-based access control
Admin, Employee, Finance, or a custom role you define — included on every plan, scoped per account, so you control exactly who on your team can see what.
Infrastructure & privacy
Data retention
How far back you import is governed by your plan's storage allowance, not a fixed time cutoff — keep as much history as fits.
Disabled, never deleted
Removing someone from your team disables their account — it doesn't erase it. Their historical activity stays intact and attributable, not orphaned.
Automated backups
Backups run on an automated schedule, independent of any single deploy or upload — not something anyone has to remember to trigger.
Questions about security?
Security or compliance questions? Email hello@gulfcommerce.ai and we'll answer plainly.