Enki IQ is built security-first. Privacy and data protection are foundational to how the platform is designed. Here's what that looks like in practice.

Authentication & Identity. Every API request is authenticated before any data is touched. Clerk manages user sessions, and there is no anonymous access to customer data.

Data Isolation. Every request is associated with a verified user and organization. Backend services confirm membership and role, then scope data access to the correct workspace before a request reaches customer information. Search embeddings follow the same organization scope, so your data never surfaces in another organization's results.

Encryption. Customer data is encrypted at rest in Aurora, secrets are kept in managed encrypted storage, and public application traffic and calls to AI providers travel over TLS.

Network Security. The database is not exposed to the public internet.

Least-Privilege Access. Each internal service has only the permissions it needs, and credentials are never hardcoded.

Infrastructure Integrity. Infrastructure is managed as version-controlled code, and database resources are protected against accidental deletion.

Observability & Monitoring. Sentry and Datadog monitor errors and application behavior in real time.

Encryption is applied across the Enki IQ platform, covering stored data, credentials, and data in transit.

Data at Rest. Customer data is encrypted at rest in Aurora, including automated backups.

Data in Transit. Public application traffic uses managed TLS, and connections between Enki IQ services and the database are encrypted.

Secrets & Credentials. API keys, passwords, and third-party tokens are kept in managed, encrypted secret storage and are never hardcoded in application code.

AI & Vector Data. Calls to AI and embedding providers are made over encrypted connections, so your data stays encrypted in transit through AI processing.

How does Enki comply with international data protection regulations?

Enki IQ is built with security in mind. Here is where we stand today.

SOC 2. Enki IQ does not currently claim SOC 2 or ISO 27001 certification. Our assurance program is being developed around documented controls, evidence, independent testing, and transparent customer review support.

GDPR Alignment. We are building toward full GDPR compliance for EU data subjects. We collect only the data necessary to deliver the service. Your data is scoped to your organization's workspace and is never pooled with other customers. Upon account termination, users have a 30-day window to export their data before it is securely deleted. Data portability is available at any time. Data Processing Agreements (DPAs) are available for enterprise customers upon request.

CCPA Adherence. Enki adheres to California Consumer Privacy Act requirements, including the right to know what data is collected, the right to deletion, and the right to opt out of data selling. Enki IQ does not sell customer data, full stop.

Your Data Is Yours. You retain full ownership of all data in Enki IQ. None of your data is shared, sold, or used to train third-party AI models. All AI processing, including Gemini Deep Research, Claude (accessed through Google Vertex AI and governed by Anthropic's terms), and Voyage AI, is performed via paid API access where provider terms exclude customer data from model training.

Built on Certified Infrastructure. Every provider in the Enki stack maintains its own certifications. Provider certifications apply to their own control environments.

• AWS: SOC 2 Type II, ISO 27001, GDPR-ready

• Clerk: SOC 2 Type II

• Sentry: SOC 2 Type II

• Anthropic (Claude): SOC 2 Type II; does not train on customer data

• Google (Gemini): ISO 27001, SOC 2; does not train on paid API data

• Voyage AI: API data not used for model training

What's Next. Our compliance roadmap includes formalizing GDPR compliance with a dedicated Data Protection Officer and evaluating ISO 27001 certification as we scale. We view compliance as an ongoing commitment, and we will keep this page current as our assurance program progresses.

For compliance or security questions, reach out to our team at security@enkiq.ai.

Yes. Enki IQ ties every request to a verified user and organization, checks membership and role, and scopes data access to your organization's workspace.

Your workspace is separate. Your accounts, contacts, opportunities, MEDDPIC captures, research outputs, Foresight theses, and pipeline data belong to your organization's workspace and are never shared with other organizations. Member-private items, such as chat threads, stay private to the member who created them.

Access is checked on every request. Backend services confirm membership and role, then scope data access to the correct workspace before a request reaches customer information.

Your AI search is isolated too. Search embeddings are scoped to your organization's workspace, so search results, research outputs, and AI-generated intelligence never mix with another organization's data.

Every request is authenticated. Session tokens issued by Clerk are validated on every API request. There is no anonymous access to customer data.

Security is built into how Enki IQ is designed. The platform uses multiple independent layers of defense so that no single point of failure can expose your data.

Private Infrastructure. The database is not exposed to the public internet.

Workspace Isolation. Every request is associated with a verified user and organization. Backend services confirm membership and role, then scope data access to the correct workspace before a request reaches customer information. Search embeddings follow the same organization scope.

Managed Secrets. Credentials are kept in managed secret storage, never in code.

Authentication on Every Request. User authentication is handled by Clerk, and session tokens are validated on every API request.

Encryption Throughout. Customer data is encrypted at rest in Aurora, and public application traffic uses managed TLS.

Continuous Monitoring. Sentry and Datadog run continuously across the stack, providing real-time error tracking, anomaly detection, and alerting on unexpected behavior.

Tracked Changes. Infrastructure is managed as version-controlled code, so every change is tracked and reviewable.

Your data is stored in private, encrypted Aurora PostgreSQL infrastructure in a United States AWS region, with multi-zone availability and automated backups that support point-in-time recovery.

Database resources are protected against accidental deletion, and our infrastructure is managed as version-controlled code, so every change is tracked.

Customer data is encrypted at rest, and public application traffic uses managed TLS.