This page summarizes where each product runs, what data it holds, and which controls protect it. The full policies, product sheets, and questionnaire answers are shared on request.
Last reviewed 2026-09-26
In AI Compass, AI Agent Factory, and AI Academy, row-level security policies in the database separate each organization, and every server function validates the session and membership before doing any work. ARIA Graph is installed per client.
All traffic travels over HTTPS. Databases and storage are encrypted at rest with AES-256. The API keys and credentials that clients connect are additionally encrypted with AES-256-GCM before they are stored.
Only designated Criterium AI staff administer the infrastructure, with personal, named accounts. Each client's users work with per-organization roles, and administrative functions are verified on the server.
Agent tools declare permissions and can require human approval before writing to a system. ARIA Graph findings require a person to accept them.
Criterium AI does not use client data to train models. We use AI providers through their commercial APIs, and in AI Compass and ARIA Graph the client can connect their own accounts.
Sensitive actions are written to audit logs, AI usage and cost are recorded per organization, and in ARIA Graph the audit log is hash-chained so tampering can be detected.
Criterium AI does not yet hold a SOC 2 report or ISO/IEC 27001 certification, and has not yet commissioned an external penetration test. Our controls are aligned with the SOC 2 Trust Services Criteria and with ISO/IEC 27001:2022 Annex A. The mapping of each control to the products is part of the documentation available on request.
| Provider | Service | Location | Products |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, CDN, DNS, and network security; AI Academy video and files | Global network | All |
| Supabase, Inc. (Amazon Web Services) | Database, authentication, files, and server functions | US: Oregon (AI Compass, AI Agent Factory) and Virginia (AI Academy, ARIA MCP) | AI Compass, AI Agent Factory, AI Academy, ARIA MCP |
| Anthropic, PBC | AI models (Claude) through the commercial API | United States | AI Compass, AI Agent Factory, AI Academy, ARIA MCP |
| Resend, Inc. | Transactional email | United States | AI Compass, AI Agent Factory, AI Academy |
| Stripe, Inc. | Payments | United States | AI Academy |
| Voyage AI | Text embeddings for tutor search | United States | AI Academy |
| Functional Software, Inc. (Sentry) | Error monitoring | United States | AI Academy |
| Twilio Inc. | WhatsApp notifications, if the learner turns them on | United States | AI Academy |
| Upstash, Inc. | Rate-limiting counters | United States | AI Academy |
| Google Cloud | Hosting of dedicated installs that Criterium AI operates | Region agreed with the client (United States by default) | ARIA Graph |
When a client connects their own AI accounts (OpenAI, Google, Microsoft Azure, or Anthropic) in AI Compass or ARIA Graph, that provider processes data under the client's contract and is not a Criterium AI sub-processor. We notify clients under contract before adding a new sub-processor.
The full documentation is shared with clients and with companies evaluating Criterium AI as a provider. Each document states which products it covers, its version, and its review date.
The overall framework: owners, risk management, personnel, assets, policy review, and exceptions.
How access is granted, reviewed, and removed for staff and for each product's users.
Encryption in transit and at rest, encryption of client credentials, and rotation of keys and secrets.
Classification levels, retention periods by product, and how deletion and data-subject requests are handled.
Backups by product, the restore procedure, critical dependencies, and how operations continue if a provider fails.
Severities, roles, containment and recovery steps, and notification timelines for clients and data subjects.
How each change is designed, reviewed, tested, and deployed, and how dependencies and vulnerabilities are handled.
How providers that process client data are assessed, contracted, reviewed, and offboarded.
Model selection, data use, evaluation, human oversight, cost control, and transparency across the products.
AI Compass architecture, data flow, per-organization isolation, authentication, AI, and logging.
Tool permissions, human approval, evaluation before promotion, execution, and credentials for agents.
Architecture, learner data, payments, video, tutor AI, retention, and user rights.
Application authentication, per-person memory, tool control, auditing, and spending limits.
Dedicated install, single sign-on, per-pack permissions, hash-chained log, outbound protection, and erasure.
The processing agreement template we sign with clients, with annexes for technical measures and sub-processors.
Each relevant SOC 2 criterion and Annex A control, with the Criterium AI control that addresses it and its status by product.
Answers to the most common vendor assessment questions, ready to copy into your format.
We review every request and reply within two business days. If it is approved, you receive a personal link valid for 30 days.
Write to hola@criterium-ai.com with the subject Security, including the steps to reproduce the issue and the affected product. We confirm receipt within two business days and let you know when it is fixed. We take no action against good-faith research that does not access third-party data, does not degrade the service, and does not disclose the issue before it is fixed. We do not run a bounty program at this time.
hola@criterium-ai.com