Trust and security
What we do, and what we haven’t done yet.
Your documents never go to a public AI API. Below is how we handle them, what is built, and what is only planned. Every line carries its status.
How to read our status
AvailableUsable by customers. Nothing yet.In developmentBeing built; parts work.In designSpecified, not built.PlannedDecided, not started.Your documents
Where your documents go, and where they don’t.
No public AI API
Every model that reads document content is an open-weight model hosted on Adduce’s own infrastructure. Document text is never sent to a public AI service.
Hosted on Microsoft Azure.
Tenant isolation
Each customer is a separate tenant on a shared platform that Adduce runs. One customer’s documents, users and settings are kept apart from every other’s.
Strictest rules first
We treat documents as if the strictest rule that could apply does: HIPAA, CUI handling, GDPR, FERPA and research-specific rules. It is how we design, not a certification.
Your own environment
On-premises, in-boundary, in-region and government-cloud deployment are not offered today. We will say so here if that changes.
Who can see what
Access is checked once, the same way, everywhere.
Passwordless email by default, multi-factor authentication, and single sign-on with your identity provider.
Every application asks the same question, “may this person do this?”, and gets one answer from one place.
Permissions are enforced passage by passage within search itself, not just at the edge of the system.
Each organization defines its own clearance tiers, with its own names and levels, down to a single document.
Nothing on screen reveals a document you may not open: no counts, no placeholders, no “hidden” badges, and no totals that include restricted items.
The record
What happened, and whether it can be repeated.
One tamper-evident record of what happened, to what and by whom, across every application, with access control and retention. Applications already emit events to it; the service itself is being built.
The same question from people with the same access gives the same answer. We engineer and test this as a guarantee.
When a person accepts, corrects or rejects a proposed value, the decision and the evidence shown are kept with the document.
No third-party scripts, fonts or analytics. Fonts are self-hosted, and nothing here tells another company you visited.
Certifications and editions
We hold no certifications today.
These are targets we have decided on. None is being pursued yet, and we will not display a badge until one is earned.
| Item | What it means for you | Status |
|---|---|---|
| SOC 2 Type II | An independent audit of our security controls over time. The audit trail is designed to support it. | Planned |
| HITRUST CSF | A healthcare-oriented security framework, relevant to medical research documents. | Planned |
| Government edition | A separate deployment for government customers. | Planned |
| EU edition | A separate deployment for customers in the European Union. | Planned |
Responsible disclosure
Report a vulnerability
If you think you have found a security issue in this site or our product, tell us privately. We will acknowledge your report and keep you informed.
info@adducelabs.com, subject “Security”