Security

Security at PrivateStack

PrivateStack, a product of Data Science & Engineering Experts, Inc. ("DSE," "PrivateStack," "we," "us," or "our"), is built for teams that need to run AI in private, controlled, and well-governed environments. Security is central to how the platform is designed and operated. This overview describes the security practices we have in place today and the areas we are actively working on. It describes our current practices; it is not a warranty. The binding terms for any tenant are set out in our Terms of Service and, where applicable, a Data Processing Addendum (DPA).

We describe our controls at the category level and design them against widely recognized security frameworks, organized here around the SOC 2 Trust Services Criteria: Security, Availability, and Confidentiality.

1. Encryption

• In transit: Traffic to and between our services is encrypted using TLS 1.2 or higher.
• At rest: Data stored in our managed infrastructure is encrypted at rest using AES-256, provided by our cloud infrastructure provider.
• Secrets: Credentials and API keys are stored in a dedicated managed secrets service, never in source code.

2. Tenant Isolation

PrivateStack is a multi-tenant platform built with logically isolated per-tenant data stores, so one tenant's data and configuration are not accessible to another. Isolation is enforced at the application and data layers, and access to tenant data is mediated by authenticated, authorized requests only. The isolation model that applies to your account depends on your deployment option (see Deployment options below).

3. Access Control & Authentication

• Authentication: User authentication is handled through a dedicated identity provider using signed, verifiable tokens (JWT), validated on every request at the API boundary.
• Role-based access: Access within the platform follows the principle of least privilege.
• Separation of duties: Administrative actions are restricted to authorized personnel, and internal access to production systems is limited and logged.

4. Deployment Options

The isolation and data-residency model that applies to your account depends on how PrivateStack is deployed for you:

Unless your organization has entered into a BYOC enterprise agreement, your deployment is the hosted model described above.

5. Infrastructure Security

• Trusted cloud foundation: Our managed services run on established, enterprise-grade cloud infrastructure with network-level isolation.
• Network controls: Services are segmented using network and security-group controls to limit exposure, and internet-facing endpoints sit behind a managed web application firewall and content-delivery/edge layer.
• Patching: We keep platform dependencies and runtimes updated to address known vulnerabilities.

6. Monitoring & Logging

We collect operational and security logs to detect, investigate, and respond to anomalies and potential incidents. Logs are retained for operational and compliance purposes as described in our Privacy Policy.

7. Secure Development

We follow secure-development practices, including code review, dependency review for known vulnerabilities, and separation of development, testing, and production environments.

8. Availability, Backup, and Disaster Recovery

• Per-tenant data stores are backed up on a regular schedule, and backups are encrypted.
• We maintain recovery procedures designed to restore service and tenant data in the event of a failure, and we validate our recovery approach as part of operating the platform.
• Backups are retained per our backup-rotation schedule; residual copies of deleted data age out through that rotation.

Specific availability or recovery-time commitments, if any, are defined in the applicable agreement, not in this overview.

9. Confidentiality and Data Handling

• Data minimization. We collect only the data we need to operate the service.
• No training on your content. We do not use tenant prompts, conversations, responses, or knowledge-base content to train models. AI and inference providers we engage do so under terms that do not permit training on our tenants' content.
• Purpose limitation. Tenant content is processed solely to deliver the service. Aggregated, de-identified usage analytics for service improvement are performed only with tenant opt-in.
• Retention and deletion. Verified deletion requests are honored. Tenant data is purged within 30 days of account termination, except where retention is required by law. Residual copies in encrypted backups age out per our backup-rotation schedule.

For full details on what we collect, how we use it, and your rights, see our Privacy Policy.

Subprocessors

We rely on a limited set of vendors, disclosed here by category rather than by name: cloud infrastructure and hosting providers; identity and authentication providers; AI model and inference providers; payment processors; analytics providers; and customer-communication providers. Our current, named subprocessor list is available to customers under the DPA on written request.

10. Compliance Posture

11. Incident Response

We maintain an incident-response process covering detection, triage, containment, remediation, and post-incident review. In the event of a security incident affecting tenant data, we will notify affected tenants without undue delay and as required by applicable law and the applicable agreement, and we will support tenants in meeting their own notification obligations.

12. Responsible Disclosure

We welcome reports from security researchers and customers. If you believe you have found a security vulnerability, please contact us so we can investigate and respond promptly. Please do not publicly disclose an issue until we have had a reasonable opportunity to address it. We will not pursue researchers who engage in good-faith, authorized testing and who avoid privacy violations, service degradation, and data destruction. Testing must be limited to your own tenant and must not target other tenants or our shared infrastructure.

13. Changes to This Overview

We may update this Security Overview from time to time. Material changes will be posted on this page with an updated effective date. This overview describes our current practices and does not create warranties or contractual obligations; binding terms are those in our Terms of Service and any applicable DPA.