This application connects to enterprise AI APIs, not consumer chatbots like ChatGPT.com or Claude.ai. Your data is never used for training, never stored in shared conversation logs, and never reviewed by humans.
The Department of Labor's EBSA released Cybersecurity Program Best Practices guidance in April 2021, updated September 2024. Below we address each of the 12 requirements.
"Responsible plan fiduciaries have an obligation to ensure proper mitigation of cybersecurity risks."
— U.S. Department of Labor, EBSA
DOL Requirement: Organizations should have a formal program that identifies and assesses cybersecurity risks.
All AI providers (Anthropic, OpenAI, Google) and infrastructure providers (Cloudflare, Box) maintain formal, documented cybersecurity programs with published security whitepapers and trust centers.
DOL Requirement: Conduct risk assessments to identify and prioritize information system risks.
Our AI providers conduct continuous risk assessments and publish annual SOC 2 reports documenting their risk management processes.
DOL Requirement: Have an independent auditor assess security controls.
All providers maintain current SOC 2 Type II certifications from independent auditors. Reports available under NDA via each provider's trust center.
DOL Requirement: Cybersecurity must be managed at senior executive level (CISO).
Anthropic, OpenAI, and Google all employ dedicated CISOs and security teams with industry certifications.
DOL Requirement: Implement MFA, role-based access, unique strong passwords.
API keys are secured in Cloudflare Workers with encrypted secrets management. All provider dashboards support MFA.
DOL Requirement: Cloud assets must be subject to security reviews and independent assessments.
All cloud providers maintain SOC 2 Type II, ISO 27001. Box.com is certified for FINRA SEC 17a-4. Google holds FedRAMP High.
DOL Requirement: Conduct annual cybersecurity awareness training for all personnel.
All AI providers require annual security training. This Security Center serves as user education on data protection.
DOL Requirement: Implement secure SDLC with penetration testing and code review.
AI providers conduct annual penetration tests, continuous code review, and maintain vulnerability management programs.
DOL Requirement: Maintain business resiliency with continuity and incident response plans.
All providers maintain documented incident response plans. Cloudflare provides global redundancy across 300+ data centers.
DOL Requirement: Implement encryption for data at rest and in transit.
In Transit: TLS 1.3 encryption. At Rest: AES-256 encryption across all providers.
DOL Requirement: Implement firewalls, intrusion detection, antivirus, patch management.
Cloudflare provides enterprise WAF, DDoS protection, and bot management. All systems maintain current security patches.
DOL Requirement: When breaches occur, inform law enforcement, notify affected participants, fix problems.
All providers maintain documented breach response procedures with defined notification timelines.
We use enterprise API tiers from the leading AI providers. Your data is never used for training and has strict retention limits.
| Security Aspect | Consumer Chatbots | Enterprise API (What We Use) |
|---|---|---|
| Training on your data | ❌ May train on conversations | ✓ NEVER trains on your data |
| Data retention | ❌ Stored indefinitely | ✓ 7-30 days max, then deleted |
| Human review | ❌ May review for quality | ✓ No human review of content |
| Privacy policies | ❌ Consumer privacy terms | ✓ Enterprise DPA / BAA available |
| Compliance | ❌ Limited certifications | ✓ SOC 2, ISO 27001, HIPAA-ready |
Understanding how your data moves through the system helps verify our security claims.
No. We use enterprise API tiers. All providers explicitly state that API data is NOT used to train models. Contractually guaranteed.
AI providers retain data for 7-30 days for abuse monitoring, then permanently delete. Anthropic offers Zero Data Retention.
No. Enterprise API data is NOT subject to human review. Only automated abuse detection processes the data.
PII is handled with extreme care. Census files are processed locally when possible. We never store SSNs. All PII in transit uses TLS 1.3.
Documents are processed locally in your browser. Only extracted text is sent — original files never leave your device.
Our infrastructure relies on SOC 2 Type II certified providers: Cloudflare, Anthropic, OpenAI, Google, and Box.com all maintain current certifications.
Anthropic: SOC 2 Type II, ISO 27001, HIPAA
OpenAI: SOC 2 Type II, ISO 27001/27017/27018/27701
Google: SOC 1/2/3, ISO 27001, FedRAMP High, HIPAA
Box: SOC 1/2/3, ISO 27001, FINRA SEC 17a-4, FedRAMP