Data Security & Architecture
We built GRC Copilot Pro for enterprise compliance teams, focusing on transparency and strict data boundaries. Here is exactly how your data is handled, stored, and processed.
1. In-Memory Document Processing
When you upload proprietary policies or vendor contracts for QA analysis, the files are parsed dynamically in-memory. We do not store the original source files you upload for analysis on our servers.
2. What We Actually Store
To provide our service, we securely persist the following in our database (Supabase): generated output documents (Word/Excel files), immutable audit logs of your generations, and structured metadata such as Risk Register entries and Vendor names.
3. Zero AI Training Policy
We route prompts through enterprise API endpoints provided by OpenAI and Google (Gemini). Under our B2B agreements, your prompts, documents, and generated data are never used to train their public or private AI models.
4. Encryption & Infrastructure
All data transmitted between your browser and our servers is encrypted using TLS 1.3. Persistent structured data (like your Risk Register) and generated output files are encrypted at rest using AES-256 within our secure cloud infrastructure.