Frameworks
What’s covered
Data at rest
- All stored data is encrypted with AES-256.
- S3 buckets use S3-managed keys (SSE-S3).
- Most DynamoDB tables use AWS-owned or AWS-managed keys. The identity and SSO tables, the search index and the authorization database use customer-managed AWS KMS keys.
- Secrets Manager secrets are encrypted with KMS, mostly under the AWS-managed key.
- Access to customer data is checked per user and per resource through OpenFGA on every request.
Backups and disaster recovery
- DynamoDB point-in-time recovery is on for most tables, with a 35-day window.
- AWS Backup covers the core application tables (model metadata, predictions, model metrics, task outputs, the dataset registry, sharing and API keys). Hourly backups are kept for 35 days, daily backups for 400 days and monthly backups for 7 years.
- Backups are encrypted and copied to a separate AWS account that Intelligible owns, in
us-east-1andus-west-2. - Primary S3 buckets replicate to buckets in
us-west-2. Old object versions expire after 30 days, and files in the upload and query-result buckets expire after 7 days. - Backup retention is separate from source-data retention. When you delete a dataset, copies of its data can remain in backups until those backups expire on the schedule above.
Data in transit
- The public API requires TLS 1.2 or later.
- Connections to your databases always use TLS, with no fallback to plaintext.
- Every database connection uses TLS and verifies the server certificate and hostname, for PostgreSQL, MySQL, Azure SQL and SQL Server. A connector can carry its own CA certificate for servers with a private CA.
- Internal service-to-service traffic is also TLS-encrypted within AWS VPCs.
Identity and access
- All authentication routed through WorkOS, which is itself SOC 2 Type II compliant.
- TOTP MFA can be required for an organization’s password sign-ins. SSO sign-ins rely on the MFA policy of your identity provider.
- Sessions are managed by WorkOS AuthKit and refresh on the standard short-cookie/long-refresh pattern.
- Cookie attributes:
HttpOnly,Secure,SameSite=Laxfor CSRF protection.
Audit and monitoring
- Every share grant, role change and revocation is written to an append-only audit table with no expiry.
- CloudWatch keeps Lambda application logs for 30 days to 1 year depending on the log group, and API Gateway and Step Functions logs for 90 days.
- An organization-wide CloudTrail trail writes to a separate log-archive account under S3 Object Lock, kept for 7 years.
- CloudWatch alarms on Lambda errors, DLQ depth, dropped audit records, and unauthorized AWS API calls.
- See Audit logs.
Operational security
- An independent firm runs a penetration test of the web application every year. The most recent was in June 2026. The report is shared under NDA on request.
- Vulnerability assessments run every quarter.
- Vanta monitors our security controls continuously.
- If we confirm a security incident involving your data, we notify affected customers within 72 hours of confirming it.
- Dependencies tracked via Dependabot; security-relevant updates merged within 7 days.
- Production access via federated identity (no shared credentials); all production sessions logged.
Personnel
- Background checks for all employees with production access.
- Annual security awareness training.
- Access provisioning and deprovisioning automated through your-IdP-of-record (we use the same WorkOS we sell).
HIPAA-specific notes
For Protected Health Information (PHI):- A Business Associate Agreement (BAA) is required and provided to all Enterprise customers handling PHI.
- PHI must be processed within Summand’s HIPAA-eligible services. By default, all Summand infrastructure is HIPAA-eligible.
- Dedicated infrastructure is not currently offered.
GDPR / data protection
- Summand processes personal data only as instructed by the customer (data controller). We’re a processor under GDPR.
- A Data Processing Addendum (DPA) is included in every Enterprise contract.
- Sub-processors are listed below. Material changes are notified 30 days in advance.
- Customer data can be deleted on request, and we confirm the deletion within 30 days. Backup copies are not removed early. They expire on the schedule in Backups and disaster recovery.
Data residency
- All compute and primary storage run in AWS
us-east-1(Northern Virginia). - Disaster-recovery copies live in
us-west-2(Oregon): S3 replica buckets in the same AWS account, and AWS Backup copies in a separate Intelligible-owned account. - Vercel hosts the frontend in the US.
- All data stays in the United States. We don’t currently host in other regions. If you need one, contact our sales team.
Subprocessors
This is the complete list.Customer responsibilities
A few controls are yours to configure:- MFA enforcement — enforce MFA at your identity provider, and ask us to require it for your organization’s password sign-ins.
- SSO setup — verify domains, configure connections.
- Sharing decisions — who you grant access to, and at what visibility.
- Off-boarding — pair SSO with Directory Sync so user removal is automatic.