Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Security and Privacy

eesel AI security and data privacy: how your data is stored, encrypted and kept, who can see it, and where eesel stands on SOC 2, GDPR, HIPAA and more.

What happens to your data, who can see it, and the compliance standards we meet. If your questions aren't answered here, contact us and we'll work with your security team directly.

Your agent reads your help center, tickets and docs so it can answer like your team does. Your data is used only for your own agent, kept separate from every other customer, and never used to train the underlying AI models.

Resources

Compliance

Standard
Status

SOC 2 Type II

In progress

GDPR

Compliant

CCPA

Compliant

HIPAA

Available on Enterprise, see FAQ

BAA

Available on Enterprise, see FAQ

Storing and processing data

Your knowledge sources are securely stored in a SOC 2 Type II certified vector database as embeddings (mathematical representations). These embeddings are what allow your agent to find relevant answers.

When a request is made, the agent uses embeddings to find related content and shares only specific relevant snippets with the AI model to generate a response.

  • Your data is used only to train your agent and generate responses

  • Your data is never used to train our underlying AI models

  • Data is isolated per workspace, your content is never shared with other customers

EU Data Residency

eesel runs on AWS in the United States. Full EU data residency is available on the Enterprise plan. All of your data stays in the EU, including AI processing.

Contact us to set it up. The full list of providers that process data for eesel is in our Privacy Policy.

Data retention

  • Your data is retained as long as your account is active

  • When you disconnect an integration or delete knowledge sources, the associated data is removed

  • When you cancel, your data is removed after your account is closed out

Custom retention arrangements are available on our Enterprise plan. If you have specific retention, residency or deletion requirements, get in touch and we'll work through them with you. See Pricing.

Encryption

  • Data is encrypted in transit (TLS 1.2+)

  • Data is encrypted at rest

  • API tokens and credentials are stored using industry-standard secret management

Access control

  • Authentication via secure login (MFA available, contact us to enable)

  • Role-based access control for team members (see Account)

  • API access is scoped per integration, we request only the permissions we need

AI model security

  • eesel AI uses leading AI models (OpenAI, Anthropic, Google) to power agents

  • Your data is sent to these model providers only for inference (generating responses)

  • No model provider trains on your data

  • The AI model never sees your credentials. Where an agent calls a connected tool or an API you've allowed, the request is made by eesel and the authentication is attached server-side, so the model knows a header exists but never its value

  • We maintain agreements with all AI model providers to ensure data protection

FAQ

Does eesel use my data to train AI models?

No. Your data is used only to train your own agent and generate its responses, and it is never used to train the underlying AI models. Model providers receive it only for inference, and none of them train on it.

Is eesel SOC 2 and GDPR compliant?

eesel is GDPR and CCPA compliant, and SOC 2 Type II is in progress. Your knowledge is stored in a SOC 2 Type II certified vector database. The Trust Center has the details.

Can my data be hosted in the EU?

Yes. Full EU data residency is available on the Enterprise plan, and all of your data, including AI processing, then stays in the EU. Contact us to set it up.

What happens to my data when I disconnect an integration or cancel?

When you disconnect an integration or delete a knowledge source, the data that came from it is removed. When you cancel, your data is removed after your account is closed out. Custom retention arrangements are available on the Enterprise plan.

How does eesel handle prompt injection?

Agents do take actions in your connected tools, so the protection isn't that the model can't act. It's that what it can act on is bounded, and you set the bounds.

It can only use actions you've enabled. Every action is enabled per agent, and each one can be set to run on its own, to require your approval every time, or to be switched off entirely. An action you haven't turned on isn't available to the model at all, whatever it's asked to do.

Anything sensitive can sit behind approval. Actions that send, refund, cancel or delete can require a human to confirm before they run. The agent prepares the action, you see exactly what it wants to do, and nothing happens until you approve it.

It can only reach domains you've allowed. For outbound API calls, requests are restricted to the domains you've explicitly added under Network Access. A request to anywhere else is refused.

It never holds your credentials. Authentication is attached by eesel when the request is made, not handed to the model, so a manipulated agent can't read out a key or token because it never had one.

Everything is inspectable. Every action an agent takes is recorded in Activity along with its reasoning, so unusual behaviour is visible rather than silent.

How do we control what an agent can see and do?

Three separate controls, all yours to set:

  • Knowledge. An agent only searches the sources you've connected to it. You choose which integrations and which files, and file access can be scoped by prefix so an agent sees only part of your library.

  • Actions. An agent can only use actions you've enabled on it, and you decide which of those need your approval.

  • Outbound requests. An agent can only reach external domains you've added under Network Access.

Agents are configured separately, so one agent having access to something doesn't give another agent the same access.

Is eesel AI HIPAA and BAA compliant?

HIPAA and a signed BAA are available on our Enterprise plan. We already work with several healthcare companies, usually alongside custom retention arrangements. Get in touch with your specific requirements and we'll work through them with you.

Does eesel have indemnity insurance?

Yes. Get in touch and we'll share the details.

Questions?

If you have security or compliance questions, or need a security questionnaire completed, start a conversation in the support chat under Help and support in your dashboard, or email hi@eesel.app.

We're happy to work with your security team on assessments and provide whatever documentation you need.

Related pages

PreviousAccount
NextPII Redaction for Past Tickets

Last updated