Security and trust

ASDK answers your website visitors from your own content. To do that, it holds two things you care about: the content of your website and files, and the conversations your visitors have with your agents. This page explains, in plain language, how we protect both.

ASDK is in early access. This page describes what we do today, not what we hope to do later, and we will update it as things change.

In short

• Data is encrypted in transit (TLS 1.2 or higher) and at rest.
• Each customer site's knowledge base lives in its own separate namespace, and your agents can only search your own content.
• Your content and conversations are used only to serve you. They are not used to train foundation models.
• Only the people who need access get it, and secrets such as integration tokens are encrypted separately.
• If a personal data breach affects your data, we tell you without undue delay, and in any case within 72 hours.
• We don't hold certifications such as SOC 2 or ISO 27001 yet, and we say so plainly.
• Found a security issue? Email security@asdk.com.

How your data moves through ASDK

1. You connect your site and upload files. Our crawler reads the pages of the website you connect, and you can upload documents.
2. ASDK builds your knowledge base. We split your content into short passages and turn each passage into an embedding, a list of numbers that lets the agent find relevant passages quickly. Passages and embeddings are stored in a separate namespace for each of your sites in our vector database.
3. A visitor asks a question. The widget sends the message to ASDK over an encrypted connection.
4. ASDK finds the answer in your content. We search only your site's namespace, pick the most relevant passages and send them, with the question and your agent's instructions, to an AI model, which writes the answer.
5. The visitor gets the answer. If the visitor leaves contact details or books a meeting, ASDK sends them to you and, if you have set it up, to tools such as your CRM or calendar.

The companies that help us at each step are listed on our Subprocessors page, with what they do, which data they handle and where.

Encryption

• In transit: all traffic between browsers, the widget, ASDK and our providers is encrypted with TLS 1.2 or higher.
• At rest: our databases, file storage and backups are encrypted.
• Secrets: access tokens for the tools you connect, such as a CRM or calendar, and API keys are additionally encrypted inside our application with AES-GCM. The encryption keys are stored separately from the data they protect.

Keeping customers apart

• Every customer site has its own namespace in the vector database. An agent searches only the namespace of the site it is installed on, so it can't answer from another customer's content.
• Every database query for customer data is limited to the account it belongs to.
• We never use one customer's content or conversations to answer another customer's visitors.

AI and your data

• No training on your data. We don't use your content or your visitors' conversations to train foundation models. The AI model providers we use process our requests under terms that prohibit training on that data. Providers may keep requests for a limited time to detect misuse; the Subprocessors page has the details.
• Untrusted input stays untrusted. Visitors' messages and website content can contain text written to manipulate an AI. We treat both as untrusted input: they can't change your agent's settings or give it access to other customers' data, and agents can only take the actions you have switched on.
• You stay in control. You choose what your agents know, how long conversations are kept and which tools they can send data to. The widget tells visitors that they are talking to an AI.

Who can access your data

• Access to production systems is limited to the people who need it for their role, and only to the extent they need it.
• Everyone uses an individual account with multi-factor authentication for production systems and for our providers' consoles.
• Access is reviewed regularly and removed promptly when it is no longer needed.
• Our team looks at your content or conversations only to give you support you ask for, to investigate a security or abuse problem, or when the law requires it.

Building and running the service

• Code changes are reviewed before they are deployed.
• We keep dependencies up to date and check them for known vulnerabilities.
• Our crawler fetches only public internet addresses, so it can't be used to reach internal systems.
• Rate limits and protection against denial-of-service attacks and bots are applied at the network edge and in the application.
• Databases and internal services are not exposed directly to the internet.
• Security-relevant events, such as sign-ins and administrative actions, are logged and kept for up to 90 days. Errors are monitored, and we configure error reports to leave out sensitive fields where possible.

Backups and availability

• Our database is backed up regularly. Backups are encrypted and expire on a rolling basis within 30 days.
• We work to keep ASDK fast and available, but self-serve plans don't come with an uptime guarantee (SLA). Our Terms of service explain this.

Retention and deletion

• Conversations: kept for 12 months by default. You can choose a different period.
• Your content: kept while it is connected. When you remove a site or a file, we delete it, including its passages and embeddings, within 30 days.
• Closing your account: we delete your content, conversations and account data from our live systems within 30 days. Copies in encrypted backups expire within a further 30 days.

If something goes wrong

We follow a documented incident response process: detect, contain, investigate, notify and learn. If a personal data breach affects your data, we notify the owner of your account without undue delay, and in any case within 72 hours after we become aware of it. The notice explains what happened, what data is affected, what we are doing about it and who to contact. We then keep you informed until the incident is resolved.

Your part

Security is shared. You can help by:

• using a strong, unique password or a secure sign-in method for your ASDK account;
• inviting only the people who need access, and removing them when they leave;
• keeping confidential material, such as passwords, internal documents or personal data you don't want to share, out of the content your agents use, because agents can quote what they know;
• checking what your agents say, and keeping the AI disclosure in the widget visible; and
• reviewing which tools you connect and what data you send to them.

Compliance and paperwork

• Data processing addendum. Our Data processing addendum applies automatically to every customer and covers GDPR Article 28, international transfers (it incorporates the EU Standard Contractual Clauses and the UK Addendum) and the CCPA. If you need a signed copy, email us.
• Subprocessors. Our Subprocessors page lists every provider. We give at least 30 days' notice before adding a new one.
• Privacy. Our Privacy policy and Cookie policy explain how we handle personal data and browser storage.
• Questionnaires. We are happy to answer reasonable security and privacy questionnaires. Email security@asdk.com.

Reporting a security issue

If you think you have found a security problem in ASDK, please email security@asdk.com with a description, the steps to reproduce it and its likely impact. We will confirm that we received your report, keep you updated while we investigate, and tell you when it is fixed.

When you research, please:

• access only the minimum data needed to show the problem, and don't access, change or delete other people's data;
• don't disrupt the service, for example with denial-of-service or load tests, and don't use social engineering or physical attacks;
• test only against your own account; and
• give us reasonable time to fix the problem before you share it with anyone else.

If you follow these guidelines, we will treat your research as authorized and in good faith, and we won't pursue legal action against you for it. We don't run a paid bug bounty program at this time.