Security Overview

Summary

Evigate reads your most confidential documents (SOC 2 reports, security policies, past questionnaires), so this page states exactly what happens to that data: what stays, what leaves, to whom, and how it is protected. Your evidence is stored in the Mumbai, India region on a single-tenant VPS, strictly isolated per organization and project, and never used to train AI models. Embeddings are computed locally, never leaving our server. Only a question plus retrieved snippets (or, for scanned PDF pages, a page image at intake) ever leaves to an AI provider, and not even that when you use your own keys.

1. What leaves your environment, and to where

Your evidence is stored in our self-hosted database and object storage on a single-tenant VPS. Embeddings are computed locally, on our own infrastructure (self-hosted bge-large-en-v1.5, via fastembed/ONNX, CPU) — chunk text never leaves our server to produce retrieval vectors. Content leaves to an outside vendor only in these cases, and only the minimum:

1. At intake, for scanned/image PDF pages only: a page with no real text

   layer is rendered as an image and sent to our AI provider (Anthropic, vision) to extract the questions on that page. Born-digital pages (with a real text layer) go through a cheap text call instead; no image is sent for those.

2. At answer time: a question plus the handful of retrieved snippets

   (never whole documents, never your full corpus) is sent to our AI provider (Anthropic) to draft a grounded answer. If that call errors, a platform-key request may automatically fail over once to Google's Gemini API (only when the operator has configured GEMINI_API_KEY); organizations using their own Anthropic key never fail over.

That is the entire external content surface. See Subprocessors.

2. Encryption

• In transit: all traffic is over TLS/HTTPS; HTTP Strict Transport Security

  (HSTS) is enforced.

• Secrets at rest: your BYOK provider keys are held under authenticated

  encryption (Fernet) and account passwords are hashed with scrypt; see §7 Secrets and BYOK.

• Storage at rest: Stored documents and database records reside on a secure, single-tenant, access-controlled VPS in Mumbai, India. We encrypt sensitive application configuration details, passwords, and user-provided API keys at rest. Host-level storage encryption is not active by default; customers with strict data-at-rest encryption requirements can utilize our self-hosted deployment option.

3. Tenant and project isolation

Every query is scoped to your organization and to a specific project. One company can never retrieve another's data, and one product's questionnaire is answered only from that product's evidence. Both boundaries are enforced on every query and covered by automated cross-tenant and cross-project tests in CI.

4. Authentication and session security

• Secure authentication via email and password, or optional federated sign-in via Google (OAuth 2.0 / OIDC) when configured. Passwords for standard email accounts are hashed using scrypt.
• Login sessions ride a hardened, HttpOnly, Secure, SameSite=Lax cookie that

  page scripts cannot read; only a SHA-256 of the session token is stored server-side, and logout revokes it immediately. Sessions expire after 7 days.

• CSRF protection (double-submit token) on every state-changing request.
• Strong-password policy (minimum 12 characters, NIST-aligned with a

  common-password blocklist), rate limiting, and account lockout after repeated failures to blunt guessing and credential stuffing.

• Password reset tokens are single-use, short-lived, stored only as hashes, and a

  reset revokes all existing sessions.

5. Application security headers and transport

Every API response carries modern browser security headers: HSTS, a strict Content-Security-Policy, anti-clickjacking (X-Frame-Options/frame-ancestors), MIME-sniffing protection, and a referrer policy. CORS is restricted to the known frontend origin(s).

6. Upload screening and safe export

• Uploads are size-capped (25 MB/file) and streamed with abort to prevent

  memory exhaustion.

• Archive-based formats (XLSX/DOCX are ZIP containers) are screened for

  decompression bombs (entry count, total uncompressed size, per-entry compression ratio), with spreadsheet dimension and PDF page caps.

• Exported spreadsheets are sanitized against formula injection so a cell can

  never execute as a formula on a reviewer's machine.

7. Secrets and BYOK

• Platform provider/billing secrets are server-side only, never sent to the

  browser, never logged.

• Customer BYOK keys are encrypted at rest with authenticated encryption,

  decrypted only at the moment of the provider call, never returned to the browser or written to logs; only the last four characters are ever shown.

• BYOK only ever applies to the LLM (Anthropic, OpenAI, Gemini, Ollama, or a

  custom OpenAI-compatible endpoint). Embeddings are never BYOK — they always run on our local platform model, so retrieval stays consistent across your corpus regardless of which LLM key you supply.

8. Logging and observability

Document contents and full AI prompts are never written to logs. Each request carries an X-Request-ID for tracing. Optional error tracking (if enabled by the operator) records error metadata, not your content.

9. No training, low retention

Anthropic is engaged under a signed no-training, zero/low-retention agreement: your content is never used to train any model and is not retained by Anthropic beyond what is needed to serve the request. The conditional Gemini fallback relies on Google's stated no-training terms for that API tier rather than a bespoke signed agreement — the same posture, on Google's standard terms. Embeddings never leave our infrastructure, so there is no retention or training exposure at that step at all. See the AI Usage Policy.

10. Your control over your data

• Delete any document at any time: deletion purges the original file, its

  chunks, and its embeddings, and removes it from retrieval. A reused answer that was grounded on a deleted source is flagged for re-verification, not silently re-served.

• Purge your entire organization and all its data (DB rows + stored files) at

  any time.

• Export a portable, secret-free snapshot of your organization's data.

11. Hosted vs self-hosted

On the hosted service we operate the controls above. If you self-host, you run Evigate in your own infrastructure and control the full environment; buyers who require that no data ever leave their own network should choose self-hosted. The controls you then operate (hosting, backups, key management, network security) are your responsibility; see Licensing.

12. Vulnerability reporting

Found a security issue? Please report it under our Responsible Disclosure Policy to security@logethos.com. We do not authorize testing that targets other tenants' data or degrades availability.

*Operator note:* certifications (e.g. SOC 2, ISO 27001) and formal penetration-test cadence are not claimed here. State them only once real; see the Trust Center.

*Effective date: July 31, 2026 · Last updated: 2026-07-21 · Version 1.1*