BBoggess AIORION · ORG-GRADE AIBoggess AI
← Trust

Compliance — Boggess AI Trust Center

SOC 2 Type II, GDPR, CCPA, and data retention policies. Boggess AI's compliance posture for regulated enterprises.

Compliance

Boggess AI maintains a rigorous compliance program designed for regulated industries. Our compliance posture is not bolt-on — it is built into the platform's architecture, development processes, and operational procedures.

SOC 2 Type II

Certification Status

Boggess AI maintains SOC 2 Type II certification covering all five trust service criteria:

Trust Service Criteria Status Scope
Security Covered All production systems and data
Availability Covered Platform uptime and disaster recovery
Processing Integrity Covered Data processing accuracy and completeness
Confidentiality Covered Customer data protection and access control
Privacy Covered Personal data handling and consent

SOC 2 Program Maturity

Our SOC 2 readiness program has gone through 13 iterations (v0.13), covering:

  • Policies: Information security, access control, change management, incident response, data retention, acceptable use, and vendor management
  • Controls: Technical controls (encryption, monitoring, access), administrative controls (training, background checks, policies), and physical controls (data center security via cloud providers)
  • Evidence: Automated evidence collection for continuous audit readiness
  • Registers: Risk register, exception register, vendor register, asset register

Report Access

The SOC 2 Type II report is available to:

  • Current customers (via customer portal)
  • Qualified prospects (under NDA — contact sales@boggess.ai)
  • Auditors and regulators (upon verified request)

GDPR (General Data Protection Regulation)

Boggess AI complies with GDPR for processing personal data of EU residents:

Data Processing

GDPR Requirement Implementation
Lawful basis Contractual necessity for customer data; legitimate interest for operational data; consent for marketing
Purpose limitation Data processed only for documented purposes in DPA
Data minimization Only data necessary for service delivery is collected
Accuracy Data quality checks in processing pipelines
Storage limitation Configurable retention periods; automated deletion on expiry
Integrity and confidentiality AES-256 encryption, access controls, audit logging

Data Subject Rights

We support all GDPR data subject rights:

  • Right of access: Export your personal data in machine-readable format
  • Right to rectification: Correct inaccurate personal data
  • Right to erasure: Delete personal data (subject to legal retention requirements)
  • Right to restriction: Limit processing of personal data
  • Right to portability: Receive personal data in structured format
  • Right to object: Opt out of processing for specific purposes

Response time: Within 30 days of verified request.

Data Processing Agreement (DPA)

A GDPR-compliant Data Processing Agreement is available for all enterprise customers. The DPA covers:

  • Scope and purpose of processing
  • Data categories and subject categories
  • Sub-processor management and notification
  • Data transfer mechanisms (Standard Contractual Clauses)
  • Technical and organizational measures
  • Breach notification procedures (72-hour notification)
  • Audit rights

International Data Transfers

For transfers outside the EEA:

  • Standard Contractual Clauses (SCCs): EU-approved transfer mechanism
  • Supplementary measures: Encryption in transit and at rest, access controls, pseudonymization where applicable
  • Transfer Impact Assessment: Documented for each data flow

CCPA (California Consumer Privacy Act)

Boggess AI complies with the CCPA and CPRA (California Privacy Rights Act) for California residents:

Consumer Rights

Right Implementation
Right to know Disclose categories and specific pieces of personal information collected
Right to delete Delete personal information (subject to exceptions)
Right to opt-out Do not sell or share personal information
Right to non-discrimination No service degradation for exercising privacy rights
Right to correct Correct inaccurate personal information
Right to limit Limit use of sensitive personal information

Notice at Collection

We provide notice at the point of collection identifying:

  • Categories of personal information collected
  • Purposes for which information is used
  • Whether information is sold or shared
  • Retention periods by category

Do Not Sell

Boggess AI does not sell personal information. We do not share personal information for cross-context behavioral advertising.

Data Retention

Retention Policy

Data retention periods are configurable per customer and per data type:

Data Category Default Retention Configurable
Meeting transcripts 2 years Yes
Email metadata 1 year Yes
Financial analytics results 7 years (regulatory) Minimum 7 years
Audit logs 7 years Minimum 7 years
User activity logs 1 year Yes
System health data 90 days Yes
Temporary processing data 24 hours No (auto-deleted)

Data Deletion

When data reaches its retention limit or a deletion request is processed:

  1. Soft delete: Data marked for deletion, removed from active queries
  2. Hard delete: Data permanently removed from all storage tiers within 30 days
  3. Backup purge: Data removed from backups on next rotation cycle
  4. Verification: Deletion confirmed and logged in audit trail

Data Location

Tier Location Encryption Purpose
HOT Local SSD (US) AES-256 Active processing
WARM MinIO (US) SSE-S3 Synced project state
ICE US cloud region AES-256 Long-term archive
Database PostgreSQL (US) TDE Structured data
Embeddings pgvector (US) TDE Semantic search

All data processing occurs within the United States. EU data residency options available for enterprise customers.

Industry-Specific Compliance

Financial Services

  • SEC compliance: Full audit trails, data lineage, and model explainability for regulatory examination
  • FINRA: Record retention and supervision requirements supported
  • Investment Advisers Act: Compliance controls for RIA operations
  • GLBA: Financial privacy protections for consumer data

Insurance

  • State insurance regulations: Data handling compliant with state insurance commissioner requirements
  • NAIC model regulations: Cybersecurity and data governance aligned with NAIC guidelines
  • Claims data protection: HIPAA-adjacent protections for claims containing medical information

Healthcare (when processing health data)

  • HIPAA: Technical safeguards (encryption, access controls, audit logging)
  • Business Associate Agreement: Available for customers handling PHI
  • De-identification: Automated PII/PHI detection and de-identification capabilities

Vendor Management

Boggess AI maintains a vendor management program for all sub-processors:

  • Due diligence: Security assessment before onboarding
  • Contractual requirements: Data protection terms in all vendor agreements
  • Ongoing monitoring: Annual re-assessment of vendor security posture
  • Sub-processor list: Available upon request; notification of changes per DPA terms

Key Sub-Processors

Vendor Service Data Processed
Anthropic LLM inference Anonymized prompts
Microsoft Graph API, Azure AD Calendar, email, meeting data
Intuit QuickBooks API Financial data
Plaid Bank API Financial account data
Twilio SMS/Voice Phone numbers, message content
ElevenLabs Text-to-speech Text content

Audit and Reporting

Continuous Compliance Monitoring

Unlike point-in-time audits, Boggess AI maintains continuous compliance:

  • SOC 2 controls monitored 24/7 via 55 health checks
  • Evidence collected automatically for audit readiness
  • Control exceptions documented and tracked to resolution
  • Risk register updated quarterly with new risk assessments

Reporting

Report Audience Frequency Access
SOC 2 Type II Customers, prospects Annual Under NDA
Privacy Impact Assessment Internal, regulators Per feature/product Upon request
Incident Reports Affected customers Per incident Direct notification
Compliance Dashboard Internal Real-time Internal only

Contact