> For the complete documentation index, see [llms.txt](https://docs.eesel.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.eesel.ai/account/security-and-privacy.md). # Security and Privacy eesel AI security and data privacy: how your data is stored, encrypted and kept, who can see it, and where eesel stands on SOC 2, GDPR, HIPAA and more. What happens to your data, who can see it, and the compliance standards we meet. If your questions aren't answered here, contact us and we'll work with your security team directly. Your agent reads your help center, tickets and docs so it can answer like your team does. Your data is used only for your own agent, kept separate from every other customer, and never used to train the underlying AI models. ## Resources * [Privacy Policy and Terms](https://www.eesel.ai/privacy) * [Trust Center](https://www.eesel.ai/security) * [Cloud Service Agreement](https://3098247345-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FUZKi9A4XwKvuOPgMvVMe%2Fuploads%2Fgit-blob-ddf501af856c1bfb6fc7ed615096569d5198d2f4%2Feesel%20Inc%2C%20Cloud%20Service%20Agreement%20-%20Sample%20v1%20\(1\).pdf?alt=media) ## Compliance | Standard | Status | | ----------------- | ---------------------------------------- | | **SOC 2 Type II** | In progress | | **GDPR** | Compliant | | **CCPA** | Compliant | | **HIPAA** | Available on Enterprise, [see FAQ](#faq) | | **BAA** | Available on Enterprise, [see FAQ](#faq) | ## Storing and processing data Your knowledge sources are securely stored in a SOC 2 Type II certified vector database as embeddings (mathematical representations). These embeddings are what allow your agent to find relevant answers. When a request is made, the agent uses embeddings to find related content and shares only specific relevant snippets with the AI model to generate a response. * Your data is used **only** to train your agent and generate responses * Your data is **never** used to train our underlying AI models * Data is isolated per workspace, your content is never shared with other customers ## EU Data Residency eesel runs on AWS in the United States. **Full EU data residency is available on the Enterprise plan.** All of your data stays in the EU, including AI processing. Contact us to set it up. The full list of providers that process data for eesel is in our [Privacy Policy](https://www.eesel.ai/privacy#subprocessors). ## Data retention * Your data is retained as long as your account is active * When you disconnect an integration or delete knowledge sources, the associated data is removed * When you cancel, your data is removed after your account is closed out **Custom retention arrangements** are available on our Enterprise plan. If you have specific retention, residency or deletion requirements, get in touch and we'll work through them with you. See [Pricing](/pricing/overview.md). ## Encryption * Data is encrypted in transit (TLS 1.2+) * Data is encrypted at rest * API tokens and credentials are stored using industry-standard secret management ## Access control * Authentication via secure login (MFA available, contact us to enable) * Role-based access control for team members (see [Account](/account/account.md#roles)) * API access is scoped per integration, we request only the permissions we need ## AI model security * eesel AI uses leading AI models (OpenAI, Anthropic, Google) to power agents * Your data is sent to these model providers only for inference (generating responses) * No model provider trains on your data * The AI model never sees your credentials. Where an agent calls a connected tool or an API you've allowed, the request is made by eesel and the authentication is attached server-side, so the model knows a header exists but never its value * We maintain agreements with all AI model providers to ensure data protection ## FAQ
Does eesel use my data to train AI models? No. Your data is used only to train your own agent and generate its responses, and it is never used to train the underlying AI models. Model providers receive it only for inference, and none of them train on it.
Is eesel SOC 2 and GDPR compliant? eesel is GDPR and CCPA compliant, and SOC 2 Type II is in progress. Your knowledge is stored in a SOC 2 Type II certified vector database. The [Trust Center](https://www.eesel.ai/security) has the details.
Can my data be hosted in the EU? Yes. Full EU data residency is available on the Enterprise plan, and all of your data, including AI processing, then stays in the EU. Contact us to set it up.
What happens to my data when I disconnect an integration or cancel? When you disconnect an integration or delete a knowledge source, the data that came from it is removed. When you cancel, your data is removed after your account is closed out. Custom retention arrangements are available on the Enterprise plan.
How does eesel handle prompt injection? Agents do take actions in your connected tools, so the protection isn't that the model can't act. It's that what it can act on is bounded, and you set the bounds. **It can only use actions you've enabled.** Every action is enabled per agent, and each one can be set to run on its own, to require your approval every time, or to be switched off entirely. An action you haven't turned on isn't available to the model at all, whatever it's asked to do. **Anything sensitive can sit behind approval.** Actions that send, refund, cancel or delete can require a human to confirm before they run. The agent prepares the action, you see exactly what it wants to do, and nothing happens until you approve it. **It can only reach domains you've allowed.** For outbound API calls, requests are restricted to the domains you've explicitly added under Network Access. A request to anywhere else is refused. **It never holds your credentials.** Authentication is attached by eesel when the request is made, not handed to the model, so a manipulated agent can't read out a key or token because it never had one. **Everything is inspectable.** Every action an agent takes is recorded in Activity along with its reasoning, so unusual behaviour is visible rather than silent.
How do we control what an agent can see and do? Three separate controls, all yours to set: * **Knowledge.** An agent only searches the sources you've connected to it. You choose which integrations and which files, and file access can be scoped by prefix so an agent sees only part of your library. * **Actions.** An agent can only use actions you've enabled on it, and you decide which of those need your approval. * **Outbound requests.** An agent can only reach external domains you've added under Network Access. Agents are configured separately, so one agent having access to something doesn't give another agent the same access.
Is eesel AI HIPAA and BAA compliant? HIPAA and a signed BAA are available on our Enterprise plan. We already work with several healthcare companies, usually alongside custom retention arrangements. Get in touch with your specific requirements and we'll work through them with you.
Does eesel have indemnity insurance? Yes. Get in touch and we'll share the details.
## Questions? If you have security or compliance questions, or need a security questionnaire completed, start a conversation in the support chat under **Help and support** in your dashboard, or email . We're happy to work with your security team on assessments and provide whatever documentation you need. ## Related pages * [PII Redaction](/account/pii-redaction.md) for removing personal details from past tickets before they are stored * [Actions and Approvals](/instructions-and-memory/actions-and-approvals.md) for what your agent may do and what asks a person first * [Network Access](/apis-and-developer-resources/network-access.md) for the domains your agent is allowed to reach * [Use eesel from Claude and other AI assistants](/apis-and-developer-resources/use-eesel-from-claude-and-other-assistants.md) and [Use eesel from ChatGPT](/apis-and-developer-resources/use-eesel-from-chatgpt.md), which sign in with your eesel account and keep your role --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.eesel.ai/account/security-and-privacy.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.