Trust & safety
Data protection, secure development, certifications and standards, subprocessors, and vulnerability reporting.
Customer data
Encrypted in transit and at rest. Not used to train models. Not sold.
Development
Code review, automated security scanning, and dependency checks on every change. Signed releases.
AI assistants
Act within user permissions, require approval before changes, and log every action.
Security practices
- TLS 1.2 or higher in transit; AES-256 at rest; customer-managed keys on Enterprise
- Single sign-on, multi-factor authentication, smart-card sign-in
- Role-based access enforced in lists, search results, embeds, and AI answers
- Write-only secrets, removed from logs and support bundles
- Tamper-evident audit log with SIEM export
- Retention policies, legal holds, verified deletion
- U.S. hosting regions; Azure Government for public-sector customers
- Annual third-party penetration testing
Certifications and standards
Reports and documentation on request. Some require a non-disclosure agreement.
| Standard | Status | Details |
|---|---|---|
| DoD Application Security and Development STIG | Aligned | Built-in STIG configuration profile enables required settings by default. |
| SOC 2 Type II | Report available | Security, availability, and confidentiality. Available under NDA. |
| NIST SP 800-171 | Self-assessed | Assessment and system security plan available to customers. |
| WCAG 2.1 AA and Section 508 | Conformant | Accessibility Conformance Report (VPAT) on request. |
| FIPS 140 | Validated modules | FIPS 140-validated cryptographic modules in government deployments. |
| FedRAMP | Customer boundary | Self-hosted Pallette operates inside the customer's FedRAMP or agency authorization boundary. Supporting documentation provided. |
Subprocessors
Contractually limited to providing Presba services. Self-hosted deployments use none unless an administrator enables a connected service.
| Provider | Purpose | Data retained | Location |
|---|---|---|---|
| Microsoft Azure | Hosting, storage, databases, and backups for Presba cloud services | Customer data, per organization retention settings | United States |
| Azure Communication Services | Account and notification email delivery | Recipient address and delivery status, up to 90 days | United States |
| Cloudflare | Web search gateway for Research and Pal | No query content; gateway logging disabled on every request | Global network |
| Ceramic | Default web search provider | None (zero data retention) | United States |
| AI model providers | Responses for Pal and Prism from organization-approved models | None. Zero-data-retention providers only. Customer-supplied API keys fall under the customer's agreement with that provider. | Per provider |
| Stripe | Card payments and billing | Billing contact and payment details; card numbers not stored by Presba | United States |
Optional providers that retain query logs, such as an alternative web search provider, are off unless an organization administrator enables them, display their retention in organization settings, and are unavailable to government organizations and under the STIG profile. Customers receive 30 days' notice before a subprocessor is added.
Vulnerability reporting
Send details and reproduction steps to security@presba.com. Reports are acknowledged within two business days, with updates until resolved. Researchers are credited on request. No legal action is taken against good-faith research that avoids privacy violations and service disruption.
Machine-readable contact: security.txt