How instantAIguru Protects Your Customer Data
instantAIguru encrypts customer data at rest and in transit, stores it in a single AWS region, and limits access to certified personnel. Here is exactly how.
This article describes instantAIguru's data posture: what is stored, where, how it is encrypted, who can reach it, and the controls you hold.
What we store, and what we do not
Conversation history is the only customer-related data we persist. It is stored in AWS DynamoDB. Every other data flow is stateless: a request to an AI vendor completes and exits, with no intermediate storage. Retrieval reads your indexed content at answer time and the request ends; there is no copy of your knowledge base baked into a model.
Encryption
- At rest: AES-256, using AWS-managed keys.
- In transit: TLS 1.2 or higher.
These are the encryption standards used across regulated industries, built on AWS's audited key-management infrastructure.
Where your data lives
All data is stored on enterprise-grade AWS infrastructure in the us-east-1 region (Northern Virginia, USA), with no replication to other regions, so you always know exactly where your customer data lives.
Access control
Access to customer data is restricted to limited certified personnel under documented least-privilege controls. Production access requires explicit authentication and is logged. Inside your own account, dashboard access is role-based, with per-user scopes you assign.
Your data is never used to train a model
Your customer conversations are never used to train any AI model, by us or by any vendor. The AI providers we route to operate under their respective API no-training terms.
Built on certified infrastructure
instantAIguru runs on SOC 2 Type II certified infrastructure. Our published sub-processors are AWS (DynamoDB, Bedrock, EC2, OpenSearch), OpenAI, Google (Gemini), Groq, Cloudflare (CDN, edge caching, Workers AI, WAF), and Stripe (billing); AWS, Cloudflare, and Stripe are SOC 2 Type II certified. For BYOC channels the Meta and Twilio accounts are yours.
The controls you hold
- Configurable retention duration for conversation history.
- Erasure of any subset on demand: a single user, a date range, or all history, from the admin portal.
- GDPR right-to-erasure honored within standard regulatory timelines.
A security posture you can verify
instantAIguru runs on SOC 2 Type II certified infrastructure, encrypts customer data at rest and in transit, restricts access to certified personnel under least-privilege controls, and performs regular internal security audits. These controls are in place by default and described in the same terms in our FAQ.
