Security Overview
How Octocom keeps your business and customer data safe — across infrastructure, organizational practice, and the AI itself. Our security model, our data protections, and where to go for the details.
Security is foundational to Octocom, not an afterthought. We handle customer conversations and connect to the systems that run your business — orders, payments, accounts — and we treat that responsibility accordingly. This page is the map: it explains how we think about security, the protections in place, and where to find the specifics.
Octocom's security work spans three fronts:
- Platform and infrastructure security — the traditional, well-established discipline of protecting a modern cloud application: encryption, network isolation, least privilege, monitoring, and disaster recovery.
- AI safety and reliability — a newer discipline, and one where we've done original work: making an AI system safe to trust with real, sensitive customer service.
- Organizational security — the people and process controls that keep the whole thing honest.
The rest of this page introduces each, with links to the detailed documentation.
How we think about security
Two principles run through everything we build.
Defense in depth. No single control is treated as sufficient on its own. Data is protected in transit and at rest; systems are isolated and access is minimized; sensitive operations are validated in more than one place. If any one layer were to fail, others still stand.
Never trust the model. This is the idea that makes AI-driven customer service safe, and it's worth stating plainly: our security does not depend on the AI behaving perfectly. Sensitive data and sensitive actions are guarded by deterministic software that you configure — not by the model's judgment. You decide what the AI can see and do; everything else is simply beyond its reach. So even if a model were manipulated, there would be nothing sensitive for it to give away, because nothing sensitive was ever the model's to hold.
We're deliberately transparent about the limits of the technology, because candor is what makes a security posture credible. No one can promise a language model will never be talked out of its instructions. We don't try to win that unwinnable race — we build so that winning it doesn't matter. The result is a system you can trust with even your most sensitive workflows.
The detail behind this lives in AI Security, AI Reliability, and Authentication & Access Control.
AI safety and reliability
Because AI is the part of Octocom that's genuinely new, it's where we've concentrated the most original security thinking. Three pages cover it in depth:
- AI Security — why an Octocom bot is safe to trust with sensitive work. How the architecture around the model, rather than the model itself, enforces every boundary.
- AI Reliability — how the bot stays accurate: grounding answers in your real knowledge and data, verifying actions before confirming them, and running anything that must be exact as deterministic code.
- Authentication & Access Control — how to verify who a customer is before unlocking anything sensitive, and how to gate private data and actions behind that verification.
Platform and infrastructure security
Octocom runs on Microsoft Azure in the European Union, engineered for confidentiality, integrity, and availability.
- Encryption everywhere. All data is encrypted in transit with strong TLS (our endpoints score an A+ on Qualys SSL Labs) and encrypted at rest with AES-256.
- Network isolation and least privilege. Systems run within isolated networks with access controls that keep unauthorized requests out, and both infrastructure permissions and employee access are baselined regularly to the minimum necessary.
- Resilience. Infrastructure is distributed across multiple Azure availability zones and auto-scales to maintain availability, with protections against denial-of-service attacks and a disaster-recovery design that survives the loss of a data center.
- Monitoring and audit. Activity is logged and shipped to centralized analysis and archival; endpoints carry real-time threat detection and response.
- Strict multi-tenancy. Safeguards ensure that data from one workspace can never surface in another.
The full control matrix — infrastructure, organizational, and product — is documented in Security Controls.
Data protection and privacy
- You own your data. Customers retain all right, title, and interest in the data they provide to Octocom. We process it to deliver the service, nothing more.
- Hosted in the EU. Octocom services and data are hosted in Microsoft Azure facilities in the European Union.
- Access, export, and deletion. You can export or delete your data in line with GDPR and other data-protection regulations. Workspace data is deleted within 30 days of a workspace being electively deleted, and workspaces inactive for 180 days are removed along with their data.
- Subprocessors. The third parties we rely on to deliver the service are listed on the Subprocessors page.
To exercise a data request, contact us at [email protected] or through your dedicated account manager.
How your data is used with AI models
The question every security team asks first: is our data used to train AI models? The answer is no.
- We never train models on your data. Octocom does not use your conversations or customer data to train or fine-tune AI models.
- Neither do our model providers. Model inference runs under enterprise agreements in which our providers commit to the same — your data is not used to train or improve their models.
- Processed only to serve you. Conversation data reaches the models solely to generate the responses in your own workspace, for no other purpose.
- Hosted in the EU. Model inference is delivered through EU-based infrastructure (see Subprocessors).
Compliance and assurance
Data protection regulation. Octocom is GDPR compliant, and we ensure compliance with the requirements of the NIS2 directive.
Secure development. Our solution development and maintenance follow established industry practices, including:
- OWASP Secure Coding Practices
- OWASP Testing Guide
- OWASP AI Security & Privacy Guide — for AI-specific risks such as prompt injection
SOC 2 alignment. We are not formally SOC 2 certified, but we operate in line with SOC 2 expectations and hold ourselves to those controls across security, availability, and confidentiality.
Penetration testing. We undergo regular third-party penetration tests; enterprise customers can request the reports.
Continuous security review. Beyond scheduled external testing, our team reviews security continuously — including internal penetration testing and the use of frontier AI models such as Claude Fable to probe our own systems. We've found these models exceptionally effective at surfacing issues, frequently outperforming traditional third-party testing in novel, AI-specific areas that fall outside standard OWASP categories.
Reporting a vulnerability
We welcome reports from security researchers and customers. If you've found a vulnerability, bug, or any security concern, please contact us at [email protected] or through your account manager, and we'll respond promptly.
Frequently asked questions
Where is our data hosted? In Microsoft Azure facilities in the European Union.
Does Octocom own our data? No. Customers retain all right, title, and interest in the data provided to Octocom.
Is our data encrypted? Yes — in transit with strong TLS, and at rest with AES-256.
Can we access, export, or delete our data? Yes. Contact [email protected] or your account manager and we'll help.
How do we report a security issue? Email [email protected] or reach out through your dedicated account manager.