Security and Privacy

What happens to your data, who can see it, how long it is kept, and the compliance standards eesel meets.

What happens to your data, who can see it, and the compliance standards we meet. If your questions aren't answered here, contact us and we'll work with your security team directly.

Resources

• Privacy Policy and Terms

• Trust Center

• Cloud Service Agreement

Compliance

Standard	Status
SOC 2 Type II	In progress
GDPR	Compliant
CCPA	Compliant
HIPAA	Available on Enterprise, see FAQ
BAA	Available on Enterprise, see FAQ

Storing and processing data

Your knowledge sources are securely stored in a SOC 2 Type II certified vector database as embeddings (mathematical representations). These embeddings are what allow your agent to find relevant answers.

When a request is made, the agent uses embeddings to find related content and shares only specific relevant snippets with the AI model to generate a response.

• Your data is used only to train your agent and generate responses

• Your data is never used to train our underlying AI models

• Data is isolated per workspace, your content is never shared with other customers

EU Data Residency

EU data residency is available upon request, your data will be hosted exclusively on EU servers. Our subprocessors (including OpenAI and Pinecone) are SOC 2 Type II certified for data security.

Contact us if you want to be hosted on EU servers.

Data retention

• Your data is retained as long as your account is active

• When you disconnect an integration or delete knowledge sources, the associated data is removed

• When you cancel, your data is removed after your account is closed out

Custom retention arrangements are available on our Enterprise plan. If you have specific retention, residency or deletion requirements, get in touch and we'll work through them with you. See Pricing.

Encryption

• Data is encrypted in transit (TLS 1.2+)

• Data is encrypted at rest

• API tokens and credentials are stored using industry-standard secret management

Access control

• Authentication via secure login (MFA available, contact us to enable)

• Role-based access control for team members (see Account Management)

• API access is scoped per integration, we request only the permissions we need

AI model security

• eesel AI uses leading AI models (OpenAI, Anthropic, Google) to power agents

• Your data is sent to these model providers only for inference (generating responses)

• No model provider stores or trains on your data

• The AI model never sees your credentials. Where an agent calls a connected tool or an API you've allowed, the request is made by eesel and the authentication is attached server-side, so the model knows a header exists but never its value

• We maintain agreements with all AI model providers to ensure data protection

FAQ

How does eesel handle prompt injection?

Agents do take actions in your connected tools, so the protection isn't that the model can't act. It's that what it can act on is bounded, and you set the bounds.

It can only use actions you've enabled. Every action is enabled per agent, and each one can be set to run on its own, to require your approval every time, or to be switched off entirely. An action you haven't turned on isn't available to the model at all, whatever it's asked to do.

Anything sensitive can sit behind approval. Actions that send, refund, cancel or delete can require a human to confirm before they run. The agent prepares the action, you see exactly what it wants to do, and nothing happens until you approve it.

It can only reach domains you've allowed. For outbound API calls, requests are restricted to the domains you've explicitly added under Network Access. A request to anywhere else is refused.

It never holds your credentials. Authentication is attached by eesel when the request is made, not handed to the model, so a manipulated agent can't read out a key or token because it never had one.

Everything is inspectable. Every action an agent takes is recorded in Activity along with its reasoning, so unusual behaviour is visible rather than silent.

How do we control what an agent can see and do?

Three separate controls, all yours to set:

• Knowledge. An agent only searches the sources you've connected to it. You choose which integrations and which files, and file access can be scoped by prefix so an agent sees only part of your library.

• Actions. An agent can only use actions you've enabled on it, and you decide which of those need your approval.

• Outbound requests. An agent can only reach external domains you've added under Network Access.

Agents are configured separately, so one agent having access to something doesn't give another agent the same access.

Is eesel AI HIPAA and BAA compliant?

HIPAA and a signed BAA are available on our Enterprise plan. We already work with several healthcare companies, usually alongside custom retention arrangements. Get in touch with your specific requirements and we'll work through them with you.

Does eesel have indemnity insurance?

Yes. Get in touch and we'll share the details.

Questions?

If you have security or compliance questions, or need a security questionnaire completed, start a conversation in the support chat under Help and support in your dashboard, or email [e-mail].

We're happy to work with your security team on assessments and provide whatever documentation you need.