Trust and security

AI you can put in front of your customers.

Certified infrastructure is table stakes. The harder question is what the AI is allowed to do.

Here is how ConvergedHub approaches data, infrastructure and AI behavior, with documentation available for review in our Trust Center.

Independently audited Request reports
SOC 2 Type 2 ISO/IEC 27001 HIPAA GDPR CCPA PentestedReport on request

SOC 2 Type 2 and ISO/IEC 27001: independently audited and certified. HIPAA, GDPR and CCPA: compliance supported through controls and contractual terms.

SSO and SCIM Data residency by region Single-tenant option DPA and subprocessor list

The risk that matters is what the AI does next.

Certifications tell you the data is handled properly. They say nothing about what the agent will say, promise or change. That behavior is governed by design.

Bounded by design

Agents run inside deterministic workflows, with explicit limits on what they can say, promise and change.

Explainable and auditable

Every interaction keeps its trace: knowledge retrieved, tools called, decisions taken and who approved the change behind them.

Private by default

PII redaction on chat and voice, field-level control over what is stored, and no personal data used for training without explicit consent.

Grounded in your knowledge

Answers come from approved knowledge sources with citations, so the agent does not improvise where accuracy matters.

Protected against misuse

Secure development, encryption in transit and at rest, and continuous monitoring across every AI pipeline.

Tested and reversible

Changes are simulated against real traffic, scored on policy and tone, versioned, and revertible in one click.

Access is explicit, scoped and auditable.

Who can see what, who can change what, and where it all runs. The controls your security review will ask for, and the infrastructure underneath them.

Identity and access

Enterprise identity, least privilege by default

SSO and SAML, with SCIM provisioning*Users arrive and leave through your directory, not a separate list of logins.
Role-based access controlRoles scope what each person can see, build, approve and export, down to the workspace.
Environment separation*Testing and production are separate environments, with separate data and separate permissions.
MFA and session managementMulti-factor authentication, session limits and revocation for every console user.
Audit logsConfiguration changes, approvals, exports and data access are recorded and exportable.
Infrastructure and resilience

Operated on hardened cloud infrastructure

AWS, in the region you choose*Isolated virtual private clouds, with a web application firewall and network controls in front of every service.
Encrypted in transit and at restTLS on every connection, and encryption at rest for transcripts, recordings and assets.
Monitored continuouslyAvailability, security events and audit logs monitored around the clock, with automated alert response.
Backups and disaster recoveryRegular backups with defined recovery objectives, and recovery plans that are tested, not just written.
Incident responseA dedicated team, a defined notification process, and post-incident notes published on the status page.

Your interaction data stays yours.

Conversations, recordings, files and the records the agent touches all sit inside your workspace, under your retention rules, in the region you choose.

Region pinning*Processing and storage kept in the region your policy requires, with a single-tenant deployment available.
Tenant and environment isolation*Customer data is logically isolated between tenants and between your own environments, with a single-tenant deployment available on Enterprise.
Retention you set*Per-type retention windows for transcripts, recordings and assets, with deletion on request honored end to end.
Not used to train foundation modelsYour conversations improve your own experience. They are never used to train shared or third-party models without explicit, informed consent.
Available in the Trust Center Get access
SOC 2 Type 2 report Reports ISO 27001 certificate Reports HIPAA report Reports Penetration test and vulnerability assessment Reports Data flow and network diagrams Architecture Data processing agreement and subprocessors Legal Incident response and BC/DR overview Resilience Security and AI governance policies Policies

Model providers are governed like any other subprocessor.

An AI platform is only as private as the providers behind it. Ours are reviewed, contracted and constrained, and the list is published.

Approved providers only

Data reaches a model provider only where that provider has been reviewed and contracted, and which model runs which step is governed by your configuration.

No training, restricted retention

Provider agreements prohibit training on your data and restrict how long prompts and responses may be retained.

Reviewed and monitored

Providers and subprocessors pass security review before onboarding and stay under our supply chain risk program afterwards.

Published, not buried

The current subprocessor list and the data processing agreement are available in the Trust Center, with notice of changes.

The program behind the certificates.

Four areas, reviewed continuously and validated by third parties. Each one has policies, owners and evidence you can request.

Governance and risk management

Enterprise-grade security through documented policy, continuous training and proactive assessment, with third-party validation.

Policies and procedures Training and awareness Risk assessments Supply chain risk

Security controls and technology

Controls across identity, application and infrastructure layers, from secure coding to real-time monitoring and response.

Access and identity MFA and RBAC App and dev security Monitoring and response Penetration testing Vulnerability and patch management Secrets management Secure SDLC

Data protection and privacy

Privacy-centric design and compliance with global data law, from classification and anonymization to user rights and breach response.

Encryption at rest and in transit Classification and anonymization Data subject requests DPIA and DPA Subprocessor management Audit logging

Operational resilience

Continuity planning, real-time platform monitoring and responsive incident management, with transparent communication.

Business continuity and DR Platform availability Incident management Status page Backup and recovery testing Breach notification

Bring your security team early.

Give your security, privacy and procurement teams the documentation and access they need from the start. The answers do not change between the demo and the contract.