Security and Data
You can develop and evaluate AI in Teammately without uploading your production Cases, customer conversations, or business records. Use synthetic Cases and fictional supporting materials to exercise the behavior your team needs. Configure the candidate's tools and credentials for a separate test environment.
Teammately also supports workflows using customer-supplied content. The data you enter, connect, generate, execute, and submit determines what each workflow processes.
Decision checkpoint
| Your question | Read | What it explains |
|---|---|---|
| Can we keep actual records outside the experiment? | Synthetic Evaluation | Constructed Cases, test-only environments, and what to inspect |
| What reaches Teammately and model services? | Data Handling and AI Processing | Inputs, outputs, providers, storage, and geographic scope |
| Who can access our work? | Access Control | Workspace, Project, reviewer, artifact, and credential boundaries |
| How do we restrict network access? | Network Controls and Isolation | IP restrictions, private ingestion and inference, and execution boundaries |
| Which actions can we inspect or export? | Audit Logs and Activity | Workspace events, filtered CSV export, and artifact-specific history |
| Which security commitments apply? | Trust Center | Published controls, assessment status, providers, and agreement requirements |
| What should procurement review? | Security Review and Assurance | Independent assessment status and workflow-specific requirements |
| How can we explain a result later? | Reproducibility | The Cases, criteria, and candidate versions used for assessment |
Security controls and commitments
| Protection | How it works | Scope |
|---|---|---|
| Customer files and backups | Azure Blob Storage encryption at rest with Microsoft-managed keys; public Blob access disabled | Customer and PostgreSQL backup storage accounts |
| Database storage | Platform-managed encryption for database-cluster disks | Database-cluster storage |
| Workspace and Project access | Server-side permissions, including direct user and workspace-group Project grants | The selected workspace, Project, and action |
| Protected files and previews | Authenticated workspace, Project access, and deletion checks | Access requires an authenticated, authorized request |
| Network access | Workspace IP restrictions and deployment-specific private connectivity | Inbound app access, ingestion, and model inference have distinct controls |
| Runtime credentials | Separate workspace secrets and explicit Harness grants | The selected Harness and its authorized execution context |
| Reviewable activity | Workspace Audit Log, artifact history, and recorded execution activity | Each surface records its own event types and scope |
| Recovery | Backup procedures, storage versioning, and soft deletion | Recovery protection and permanent erasure have different lifecycles |
The Trust Center gives the individual control descriptions, assessment methods, and dates. Core hosting location, model-processing geography, and traffic delivery are separate considerations.
Teammately does not use customer workspace data to train shared generative models without express written agreement. Providing a requested AI service can still involve processing and retaining content. Review the selected workflow and provider terms separately.
Compliance and procurement
Use the Trust Center for Teammately's assessment and audit status, and the applicable agreement for contractual commitments. Each assessment identifies the organization and services it covers. Review the controls and agreement that apply to your intended workflows.
Teammately's security program follows the SOC 2 Security criteria, with controls assessed internally. An independent SOC 2 Type II audit is in progress. Security Review and Assurance explains how to review the assessment status and the scope of your intended workflows.
HIPAA-compliant deployments require a signed Business Associate Agreement and deployment approval before protected health information is submitted. The approved services, workflows, integrations, and data categories define that scope.
Retention, deletion, recovery, and processing requirements should cover the intended workflow, including model-service records, logs, files, and backups. A recovery window is separate from a permanent-erasure timeline.