Security & compliance
Private by default.
Achiral is built so your team’s memory, conversations, and automations stay inside one organization’s boundary.
Summary capsule
Achiral is designed so each organization has its own tenant boundary for memory, retrieval, connectors, and assistant activity. Traffic is encrypted in transit, stored credentials are encrypted at rest, access is scoped by role, and customer content is not used to train AI models.
Tenant boundary
One organization. One tenant. One boundary.
Every Achiral organization runs on its own subdomain and gets a dedicated memory tenant. Inference, retrieval, and stored context all live inside that boundary. Cross-organization access is not part of the product design.
Inside the tenant, an org-wide Chiro and per-teammate executive assistants share context only where you’ve explicitly given access. Personal EAs cannot read across each other’s scopes.
The same boundary applies to every connector. See integrations for the inventory.
Encryption
Encrypted in transit. Credentials encrypted at rest.
Traffic between your browser and Achiral is encrypted in transit. Connector tokens, model-provider keys, database connection strings, and ingestion secrets are encrypted at rest with AES-256-GCM. Tenant-scoped API keys authenticate clients without exposing shared secrets across organizations.
Chiro generates answers through the model provider your organization connects, under your own account. Embeddings for memory search stay on models Achiral hosts. See the Data Processing Policy for what goes where. Memories, their embeddings, and connected source data are stored and indexed on infrastructure Achiral operates. Achiral does not offer a choice of data region yet.
Access controls
Roles you already use, audited end to end.
Achiral honors the roles, groups, and access patterns your team already runs. Role-based access controls gate every connector, every action, and assistant workflow. Users sign in with single-use email links, so there are no passwords to steal.
Access to memory is recorded in a tenant-scoped log that admins can review and export. The agentic loop ships with a human approval step before any outbound action runs — see how that feels on /features.
Compliance posture
Compliance-ready, with the wording we can stand behind.
Achiral is built for regulated SMB workloads. We use the language below intentionally — it reflects what we have actually shipped and what is in progress, not aspirational claims:
- BAAs available for qualifying customers. HIPAA does not have a certification regime; we sign Business Associate Agreements with covered entities and operate to the relevant safeguards.
- SOC 2 audit work in progress. We will publish the report and audit scope when it is in hand.
- DPAs available for qualifying customers. Data Processing Addenda available on request.
For service-level commitments, see the Service Level Agreement.
Have a specific compliance question?
We’ll answer with what’s shipped, what’s in progress, and what we can sign for you.