How we protect your data
condense is a context-compression proxy for LLM workloads. Conversations, prompts, and compressed context flow through our infrastructure, so security and privacy are not features, they are the product. Here is how we protect your data, and where we stand on the compliance regimes that matter.
- GDPRData protectionDPA available
- SOC 2 Type IIIndependent auditIn progress
- ISO 27001:2022Information securityIn progress
Keeping your data secure
For developers
Your keys and traffic, protected by default.
- Your upstream provider key is never stored, only a sha256 fingerprint in the usage ledger.
- Traffic is encrypted in transit with TLS 1.2+, and stored data at rest with AES-256.
- We never train on your data.
- Conversation content is deleted after 7 days of inactivity, with zero data retention (ZDR) available on request.
- SSO and 2FA protect your account.
For teams
Layered controls for organizations.
- Application hosting and storage in AWS Europe (Spain); requests to api.us.condense.chat are processed in the US.
- Every privileged action is written to an audit trail that the database enforces as append-only.
- DPA available; GDPR data export and erasure honored.
- SOC 2 Type II and ISO 27001:2022 are in progress.
- Staging and production use separate databases and credentials.
Security at every step
Defense in depth
TLS 1.2+ with HSTS, AES-256 at rest with AWS-managed keys, non-root containers with read-only filesystems, and version-controlled deploys that are reviewed before release.
Data & privacy
We never train on your data, your upstream key is never stored, and conversation content is deleted after 7 days of inactivity, with zero data retention available on request. Our application storage is in the EU; see our subprocessor list for provider locations.
Compliance
A DPA covering international transfers is available. SOC 2 Type II and ISO 27001:2022 are in progress. Every privileged action lands in an append-only audit trail.
Reporting an issue
Found a vulnerability? We welcome good-faith disclosure. Email team@condense.chat and we will respond quickly.
Where we stand on compliance
condense is built and hosted in the EU, on AWS Europe (Spain). Requests sent to api.us.condense.chat are processed in the US, and some providers process data outside the EU under the safeguards in our subprocessor list. We support GDPR obligations including data export and erasure. SOC 2 Type II and ISO 27001:2022 are in progress. We are happy to walk a security or procurement team through our controls, just reach out.