---
id: security.assurance
title: Security assurances
summary: Review Teammately's current assessment status and define the identity, processing, retention, recovery, and regulatory requirements of your intended workflows.
kind: reference
product_area: security
status: stable
updated: 2026-11-11
canonical: /docs/security/assurance
---

# Security assurances

## Definition

A security review connects your intended use with the applicable technical controls, operating responsibilities, provider terms, and agreements. Identify the workflows and information involved before treating a general security statement as a commitment for every operation.

## Fields, states, or lifecycle rules

### Assessment status

Teammately's security program follows the SOC 2 Security criteria, with controls assessed internally. An independent SOC 2 Type II audit is in progress. The [Trust Center](https://teammately.ai/trust) publishes the current status and gives the method and date for individual control descriptions.

Internal control review, adopted security policies, and a completed independent assessment are different forms of assurance. When reviewing a report, check the legal entity, included services, assessment period, exclusions, and customer responsibilities. Hosting and model-provider reports describe the provider controls within their stated scope; Teammately's assessment covers its own included services and workflows.

### Define the intended use

| Review topic | Establish for the selected workflows |
| --- | --- |
| Information submitted | Cases, Project instructions, Reference Materials, expert content, files, outputs, and recorded activity; whether production records are excluded |
| Identity | Required sign-in or SSO method, MFA enforcement, account provisioning and removal, and session requirements for the agreed identity setup |
| Authorization | Workspace roles, direct and group Project grants, reviewer assignments, artifact access, API credentials, and Harness grants |
| Network | Inbound IP restrictions, private ingestion, private model inference, endpoints, and network owners |
| Processing location | Core hosting, the selected model deployment, traffic delivery, and connected service locations |
| Provider processing | Data sent to each service, requested model features, stateful storage, and the applicable processing and training terms |
| Audit | Required event types, authorized readers, review periods, export needs, and retention scope |
| Retention and deletion | Active records, files, recordings, model-service state, logs, backups, and the treatment of deleted content after restoration |
| Recovery | Required recovery point and recovery time, backup scope, restoration responsibilities, and the workflows the commitment covers |
| Personnel and support | Authorized business purposes for content access and the responsibilities of your administrators and participating experts |

Review the sign-in methods, MFA policy, provisioning integrations, and session settings configured for your deployment against your organization's identity requirements. Domain restrictions govern which email domains are permitted for invitations.

### Regulated information

HIPAA-compliant deployments are available under a signed Business Associate Agreement and deployment approval. Complete both before submitting protected health information. The agreement identifies the approved services, workflows, data categories, integrations, providers, and responsibilities. PHI processing follows this approved deployment and agreement scope.

The Privacy Policy describes website, account, and business-administration processing. Customer workspace content is processed on the customer's instructions. The purpose and applicable agreement determine the processing role.

### Prepare a review request

Use the [Trust Center](https://teammately.ai/trust) contact destination to share your required workflows and controls. Include the categories of information and required locations, access, audit, retention, and recovery terms. Keep actual customer records, credentials, and regulated information out of the initial inquiry.

Record the agreed scope with your organization. Technical settings, contractual requirements, and independent assessment status should remain identifiable separately as the use changes.

## Related task pages

{% related-card-grid title="Review the relevant controls" %}
- [Data Handling and AI Processing](/docs/security/data-handling)
- [Access Control](/docs/security/access-control)
- [Network Controls and Isolation](/docs/security/network-isolation)
- [Audit Logs and Activity](/docs/security/audit-activity)
- [Evaluate Without Uploading Production Cases](/docs/security/synthetic-evaluation)
{% /related-card-grid %}