| Certifications | SOC 2 Type II compliant, ISO/IEC 27001:2022 certified, PCI DSS Level 1 certified |
| Payment card data | PCI DSS Level 1 certified; attestation (AOC) through your Fini account team. PCI DSS |
| Privacy frameworks | GDPR, CCPA |
| Healthcare | HIPAA-compliant, BAA-eligible, with the BAA available on every plan (typically about one week, through your Fini account team). HIPAA and BAAs |
| Model training | Fini does not use customer data to train foundation models. |
| Sensitive data masking | Fini automatically masks sensitive data, including card numbers and health details, everywhere it stores conversation data (transcripts, Inbox and AI Steps traces). Fields you hide from the AI are also redacted in AI Steps |
| Encryption | AES-256 at rest, TLS 1.2+ in transit |
| Data residency | US or EU, as you designate. With EU data residency, data is stored and processed in the EU. |
| Subprocessors | Google Cloud (including Gemini): hosting, AI. Microsoft Azure: Azure Marketplace deployments, incl. Azure AI Foundry / Azure OpenAI. Supabase: managed database. OpenAI and Anthropic: LLM inference, enterprise agreements. PostHog: product analytics, usage metrics only. Sentry: error monitoring and logging. Stripe: billing. Linear: issue tracking. Google: email. Langfuse: tracing. Data handling |
| Single sign-on | Okta, Google, Slack and Microsoft Entra ID |
| DPA | v1.0.5: 30-day subprocessor change notice, 72-hour breach notification, EU SCCs (Modules Two and Three), Swiss and UK addenda. DPA |
| Retention | You set your own retention period; deletion removes all data. Deletion within 30 days of termination under the Terms of Service |
| Audit logs | Customers can export audit logs |
| Cyber insurance | In place |
| Penetration testing | Annual, third party |
| Recovery Time Objective | 24-48 hours (Trust Center risk profile) |
| Trust Center | security.usefini.com: policies, pentest report, SOC 2 and ISO reports, DPA, and subprocessor details, on request |
