Security & trust

How we protect your data

condense is a context-compression proxy for LLM workloads. Conversations, prompts, and compressed context flow through our infrastructure, so security and privacy are not features, they are the product. Here is how we protect your data, and where we stand on the compliance regimes that matter.

  • GDPRData protectionDPA available
  • SOC 2 Type IIIndependent auditIn progress
  • ISO 27001:2022Information securityIn progress
EU application hostingSSO + 2FAContent deleted after 7 days idleNo training on your data

Keeping your data secure

For developers

Your keys and traffic, protected by default.

  • Your upstream provider key is never stored, only a sha256 fingerprint in the usage ledger.
  • Traffic is encrypted in transit with TLS 1.2+, and stored data at rest with AES-256.
  • We never train on your data.
  • Conversation content is deleted after 7 days of inactivity, with zero data retention (ZDR) available on request.
  • SSO and 2FA protect your account.

For teams

Layered controls for organizations.

  • Application hosting and storage in AWS Europe (Spain); requests to api.us.condense.chat are processed in the US.
  • Every privileged action is written to an audit trail that the database enforces as append-only.
  • DPA available; GDPR data export and erasure honored.
  • SOC 2 Type II and ISO 27001:2022 are in progress.
  • Staging and production use separate databases and credentials.

Security at every step

Defense in depth

TLS 1.2+ with HSTS, AES-256 at rest with AWS-managed keys, non-root containers with read-only filesystems, and version-controlled deploys that are reviewed before release.

Data & privacy

We never train on your data, your upstream key is never stored, and conversation content is deleted after 7 days of inactivity, with zero data retention available on request. Our application storage is in the EU; see our subprocessor list for provider locations.

Compliance

A DPA covering international transfers is available. SOC 2 Type II and ISO 27001:2022 are in progress. Every privileged action lands in an append-only audit trail.

Reporting an issue

Found a vulnerability? We welcome good-faith disclosure. Email team@condense.chat and we will respond quickly.

Where we stand on compliance

condense is built and hosted in the EU, on AWS Europe (Spain). Requests sent to api.us.condense.chat are processed in the US, and some providers process data outside the EU under the safeguards in our subprocessor list. We support GDPR obligations including data export and erasure. SOC 2 Type II and ISO 27001:2022 are in progress. We are happy to walk a security or procurement team through our controls, just reach out.