Security and privacy, built into the architecture.
Everything your security, legal, and procurement teams need to evaluate Chariot — the isolation model, our certifications, how we handle data, and the documents to back it up.
Independent audit of our security, availability, and confidentiality controls, mapped to the Trust Services Criteria.
Administrative, physical, and technical safeguards for protected health information.
EU data-protection obligations met, with a Data Processing Agreement available.
California consumer-privacy rights honored, with documented data-subject workflows.
Isolation by design, not by policy.
Every agent runs in its own sealed, persistent workspace. There is no shared memory, no shared network path, and no route by which one user's agent can reach another user's data. Privacy isn't a setting you trust us to keep — it's the shape of the system.
How your data is stored, moved, and retired.
TLS 1.2+ in transit and AES-256 at rest, with managed key rotation.
Customer and end-user data is never used to train shared or third-party models.
Choose where data is processed and stored, with region-pinned deployments.
Configurable retention windows and verifiable deletion on request or offboarding.
A current list of subprocessors, with advance notice of any material change.
Agents see only the scoped context they need — nothing broader is ever exposed.
Everything your reviewers ask for.
Found something? Tell us.
We welcome reports from security researchers and triage every submission. Encrypt sensitive details with our published PGP key.
security@go-chariot.comTalk to our security team.
Get the full document set, a custom questionnaire response, or a live architecture review.