AskVault security overview - encryption, isolation and compliance
The short version
This page lists what we do to protect your data and, just as plainly, what we do not offer yet. If a security review needs something that is not here, email [email protected] and we will give you a straight answer.
| Area | What AskVault does |
|---|---|
| Storage | Managed database storage with a provider that holds a SOC 2 Type II report |
| Encryption at rest | AES-256, applied by the database provider |
| Encryption in transit | HTTPS with TLS 1.2 or higher; HSTS with preload (365 days) on the API |
| Workspace isolation | Every data query is filtered to a single workspace |
| API keys | Stored as SHA-256 hashes; the full key is shown once |
| Channel secrets | Bot tokens, webhook secrets and OAuth tokens encrypted in the app before they are saved |
| Location | One region, in the United States |
| Health data | Not supported: no BAA |
How workspaces are kept apart
AskVault is multi-tenant, which means many workspaces share the same database, whether an account has 1 workspace on Free or 15 workspaces on Business. Keeping one customer's data out of another customer's answers is the most important job the platform has, and it is handled in three ways.
- Every query is scoped. Searches over your indexed content, and reads of your conversations and documents, carry your workspace ID and only return rows that belong to it.
- API keys belong to one workspace. A key is bound to its workspace when it is created, and the API takes the workspace from the key rather than from anything the caller sends.
- Identifiers are random. Workspaces, documents and conversations use random UUIDs, not counting numbers that could be guessed.
Read more in single-tenant vs multi-tenant.
Encryption
At rest. Indexed text, embeddings and conversations are stored in a managed Postgres database (Neon), which encrypts storage with AES-256 and holds a SOC 2 Type II report. Uploaded files and a secondary search index are also kept on our application hosting (Fly.io). AskVault also encrypts the most sensitive settings, such as channel bot tokens, webhook secrets, email passwords and OAuth tokens, inside the application before they are written.
In transit. The API (api.askvault.co) sends HSTS with preload and a 365-day max-age. All AskVault sites use HTTPS with TLS 1.2 or higher.
API keys. Keys look like ak_... and are sent as Bearer tokens. AskVault keeps only a SHA-256 hash, so a lost key cannot be recovered; create a new one under API keys and revoke the old one.
Who can see what inside a workspace
Teammates get one of four roles: viewer, support, member and admin. Viewers can read, members can also edit content, and admins can manage channels and the team. Billing belongs to the account owner, who can also delete the workspace. See team management.
Your data and AI models
AskVault does not train or fine-tune models on your content. When a visitor asks a question, the passages that match it are sent with the question to a third-party model provider to write the answer. The provider list is available on request from [email protected].
Deleting and exporting data
Workspace owners can delete a workspace from Settings > Danger Zone, which removes its documents, indexed content and conversations. Data-subject requests and exports are covered on the GDPR page and in data handling.
What we do not offer yet
We would rather you hear this from us than find it in a questionnaire.
- No AskVault-owned SOC 2 or ISO 27001 report. The SOC 2 Type II report belongs to our database provider.
- No BAA and no HIPAA compliance. Do not send protected health information. See HIPAA.
- No EU data residency. Data stays in one US region.
- No independent penetration test or bug bounty yet. See penetration testing.
- No uptime SLA with service credits. See SLA.
- No customer-managed encryption keys.
Reporting a vulnerability
Send security reports to [email protected]. We will confirm we have it, keep you updated while we look into it, and credit you once it is fixed if you would like. We are a small team and do not promise a fixed response time, and there is no bug bounty.
FAQ
Is AskVault SOC 2 certified?
AskVault does not hold its own SOC 2 report. Your data is stored with a database provider that holds a SOC 2 Type II report.
Where is my data stored?
In one region in the United States.
Does AskVault train AI models on my data?
No. Matching passages are sent to a model provider only to answer the question being asked.
Can I use AskVault for health information?
No. There is no BAA, so do not send PHI.