Security
Stated plainly, the way we'd want a vendor to state it to us.
Encryption
Sensitive data is encrypted at rest (AES-256) in the database and in file storage, and encrypted in transit (TLS) everywhere between your browser, our servers, and our AI infrastructure.
Seller isolation
Every account is fully isolated. Nothing is ever pooled, benchmarked, or compared across sellers — every query, report, and AI request is scoped strictly to your own account.
Decrypt-on-demand
Data is only decrypted in the application layer, at the moment a specific request is built — never cached or stored decrypted. Role and permission checks happen before decryption, so a blocked user's request never reaches that step.
AI request boundary
The GPU worker that powers Chat never touches the database or encrypted storage directly. It receives only the decrypted, request-scoped payload for that one request, in memory, and does not persist it afterward.
Access control
Role-based access control (Admin, Employee, Finance, or a custom role you define) is included on every plan, scoped per account, so you control exactly who on your team can see what.
Data retention
We accept up to 5 years of historical data on import, identically across every plan — old enough for any real decision, without holding data indefinitely for no reason.
Questions about security or compliance? Emailhello@gulfcommerce.ai.