Security & compliance
Private by default.
Achiral is built so your team’s memory, conversations, and automations stay inside one organization, on infrastructure you control.
Summary capsule
Achiral is designed so each organization has its own tenant boundary for memory, retrieval, connectors, and assistant activity. Customer context is encrypted at rest and in transit, scoped by access controls, and not used to train shared models.
Tenant boundary
One organization. One tenant. One boundary.
Every Achiral organization runs on its own subdomain and gets a dedicated memory tenant. Inference, retrieval, and stored context all live inside that boundary. Cross-organization access is not part of the product design.
Inside the tenant, an org-wide Chiro and per-teammate executive assistants share context only where you’ve explicitly given access. Personal EAs cannot read across each other’s scopes.
The same boundary applies to every connector. See integrations for the inventory.
Encryption
Encrypted at rest. Encrypted in transit.
Conversations, memory, and connector context are encrypted at rest in your tenant’s storage layer and encrypted in transit between every internal service. Tenant-scoped API keys authenticate clients without exposing shared secrets across organizations.
Data-residency controls are available on request for customers with jurisdictional requirements.
Access controls
Roles you already use, audited end to end.
Achiral honors the roles, groups, and access patterns your team already runs. Role-based access controls gate every connector, every action, and assistant workflow. Multi-factor authentication is available for every account.
Every approval, every action Chiro takes on a teammate’s behalf, and every change to a workflow is recorded in a tenant-scoped audit log you can review or export. The agentic loop ships with a human approval step before any outbound action runs — see how that feels on /features.
Compliance posture
Compliance-ready, with the wording we can stand behind.
Achiral is built for regulated SMB workloads. We use the language below intentionally — it reflects what we have actually shipped and what is in progress, not aspirational claims:
- BAAs available for qualifying customers. HIPAA does not have a certification regime; we sign Business Associate Agreements with covered entities and operate to the relevant safeguards.
- SOC 2 audit work in progress. We will publish the report and audit scope when it is in hand.
- DPAs available for qualifying customers. Data Processing Addenda available on request.
For service-level commitments, see the Service Level Agreement.
Have a specific compliance question?
We’ll answer with what’s shipped, what’s in progress, and what we can sign for you.