Key Takeaways
- SOC 2 Type II certified with annual audits by independent assessors
- AES-256 encryption at rest, TLS 1.3 in transit for all data
- No AI training on customer data — your documents improve only your instance
- Data residency options: US, EU, or single-tenant deployment
- Configurable retention policies with automated purge capabilities
- SSO integration (SAML 2.0, OIDC) with role-based access control
- Comprehensive audit logging for compliance and investigation
What Ultrassure Does
- Maintains SOC 2 Type II certification with continuous monitoring
- Provides customer-specific encryption keys for sensitive deployments
- Offers single-tenant deployment for maximum isolation
- Integrates with enterprise SSO providers (Okta, Azure AD, Ping)
- Generates compliance reports for auditors and regulators on demand
Frequently Asked Questions
Does Ultrassure train AI models on my data?
No. Your documents and extracted data are never used to train AI models. Our models are trained on licensed datasets and synthetic data. Any instance-specific learning stays within your tenant and is not shared.
What is SOC 2 Type II certification?
SOC 2 Type II is an audit standard that verifies security controls are designed and operating effectively over time. Our certification covers Security, Availability, and Confidentiality trust service criteria with annual renewal.
Where is my data stored?
Default deployment is in US-based data centers (AWS). EU data residency is available for GDPR compliance. Single-tenant deployments can be configured in additional regions on request.
How long is data retained?
Retention policies are configurable by customer. Default retention is 7 years for extracted data and 30 days for uploaded documents (configurable). Automated purge ensures data deletion at policy expiration.
What happens to my data if I cancel?
Upon contract termination, you receive a full data export. After a 30-day grace period, all customer data is permanently deleted from production and backup systems with certification provided.
Does Ultrassure support SSO?
Yes. We support SAML 2.0 and OIDC for SSO integration. Common providers include Okta, Azure AD, Ping Identity, and OneLogin. Role-based access control maps to your existing groups.
How are API keys and credentials managed?
API keys are encrypted, rotatable, and scoped to specific permissions. Credentials never leave your environment. Integration with secrets managers (AWS Secrets Manager, HashiCorp Vault) is supported.
What audit logging is available?
Comprehensive audit logs capture all user actions, data access, configuration changes, and system events. Logs are immutable, exportable, and retained for compliance requirements.
Is Ultrassure GDPR compliant?
Yes. We provide Data Processing Agreements (DPAs), support data subject access requests, enable data portability, and offer EU data residency. Our practices align with GDPR requirements.
How do I report a security concern?
Security concerns can be reported to security@ultrassure.com. We maintain a responsible disclosure policy and respond to reports within 24 hours. Bug bounty details are available on request.