Control stays with you, at every layer.
You decide what agents can access, which actions they take, and where they wait for approval. Customer data is not used to train foundation models; each tenant's data stays in its own scope.
Six layers of control
Pick a layer
Who signs in and with which role.
- Enterprise SSO and SCIM connection paths are documented and wired in when your environment is ready.
- Users are managed with roles: who uses, who manages.
A document's journey
From upload to answer, a document passes a control at every step.
Upload
Encrypted in transit with TLS.
Storage
AES-256 class encryption at rest; tenant-owned scope.
Search
Only sources the tenant and agent can access are searched.
Model call
Data isn't used for model training; your own key on eligible models.
Answer and record
The answer shows its source; the action record is open to admins.
Who manages what?
Security is shared work. The platform provides the controls; your team decides how to use them.
Identity and access
- ajan provides
- Roles, SSO and SCIM connection paths
- You manage
- Who works with which role, your identity provider
Knowledge sources
- ajan provides
- Tenant-scoped storage and search
- You manage
- Which document is open to which agent
Actions
- ajan provides
- Automatic / approval / off setting
- You manage
- Each action's setting and its approver
Models
- ajan provides
- Model access policy, BYOK
- You manage
- Which model is open to whom, your own keys
Usage
- ajan provides
- Visibility and limits by user, agent, and model
- You manage
- Limit values and tracking
Retention and deletion
- ajan provides
- Processing deletion requests per the process
- You manage
- Retention period and legal process
Open status
We state plainly what's live, what's decided at setup, and what hasn't been published yet. No borrowed seals.
- In the product
- Set at onboarding
- Not published
- In the product
No model training on customer data
Prompts, uploads, and outputs are not used to train foundation models.
- In the product
Encryption in transit and at rest
TLS and AES-256 class encryption are baseline engineering controls.
- In the product
Approved actions and action records
Approval at chosen steps; records open to admins.
- Set at onboarding
SSO and SCIM
Connection paths are documented and wired to your identity provider at setup.
- Set at onboarding
Hosting region
Decided with you at onboarding; this site doesn't invent a location.
- Not published
Independent audit certificates
Shown here with the document once published.
- Not published
Service level commitment
No published commitment; enterprise needs are discussed with sales.
If you're running a security review
We can walk through these topics together as part of your pre-purchase security assessment.
- Tenant isolation and access model
- Identity provider connection (SSO, SCIM)
- Action permissions and approval flows
- Model providers and data flow
- Retention, deletion, and records
- Deployment options
Reporting a vulnerability
If you've found a vulnerability, choose the "Security and privacy" topic on the contact form. Don't paste passwords, keys, or personal data into the form; we'll get back to you for details.
Security questions
What security and privacy teams ask most.
All FAQs
No. Prompts, uploaded documents, and outputs are not used to train or fine-tune foundation models.
Start without giving up control.
Try a free workspace, or let's talk it through with your security team.