Trust Center

What this product does with your data, where AI inference runs, and what we do not claim. Every statement here is one we can evidence; where something is not yet true, this page says so rather than omitting it.

Your data

Tenant isolation: Every route, query, job, export and AI tool is tenant-scoped server-side. UI hiding is never treated as authorization.
Credentials you enter: Provider keys, connector credentials and webhook signing secrets are encrypted at rest with a dedicated data-encryption key, separate from the key that signs sessions. They are masked in the interface and never returned to the browser.
Your session: Session tokens are httpOnly cookies. No token is placed in browser storage, and unsafe requests carry a CSRF token.
Transport: TLS everywhere. The product does not serve or accept plaintext HTTP in production.

AI processing

Where inference runs: Each request resolves its effective AI runtime against a signed registry and applies that runtime's data rules. A provider name is never treated as proof of where inference executes.
What we do not yet claim: Production customer data is not approved for AI processing today. No runtime in the current registry permits it, so AI features operate on synthetic and approved-public content only. We would rather say this plainly than imply an approval that does not exist.
Your content is not training data: Tenant content is used to ground answers for that tenant. It is not used to train shared models.
Human authority: AI never writes to a system of record on its own. Material changes are proposed and a person approves them.

Compliance posture

Health information: The product stores no structured patient or provider health fields. A formal HIPAA relationship determination has not been completed, so we make no HIPAA claim. If your use involves protected health information, raise it before onboarding.
Certifications: No external certification is claimed. Where evidence exists it is internal control evidence, and we will say which.
Data residency: Hosting, processing and AI-inference locations are declared per deployment. Ask for the current statement for your tenant rather than assuming a region.

Reporting and contact

To report a security issue, contact your implementation lead or the administrator who provisioned your workspace. Include what you observed and when; please do not include credentials or customer data in the report.

Service status and planned maintenance are published at status.sageaiapps.com.

Accessibility

SageAI Build A Chatbot targets WCAG 2.2 Level AA. Every screen is built to be operable by keyboard alone, to carry visible focus, to reflow at 320 CSS pixels and 200% zoom without loss of function, to respect reduced-motion and forced-colors preferences, and never to convey meaning by colour alone.

This is a statement of the standard we hold ourselves to and what we currently know, not a claim of perfection. Known gaps are tracked as defects with the same weight as functional ones: accessibility findings of serious or critical severity fail the release gate rather than being deferred. The browser support floor is Baseline widely available.

Telling us about a barrier

If any part of this product prevents you from completing a task, report it to your implementation lead or the administrator who provisioned your workspace, with the subject line Accessibility barrier. Describe the screen, what you were trying to do, and the assistive technology and browser you were using. Please do not include credentials or customer data.

What happens next. We acknowledge a reported barrier within 5 working days and give an assessment with either a fix or a dated plan within 20 working days. Reports are tracked to closure and their age is reviewed at each release, so a report cannot quietly go stale. If a barrier blocks you from working, say so in the report and it is treated as urgent.