Trust center
Built to pass your security team’s review
Your documents are often confidential, sometimes sensitive. Broca is built so you can prove it is safe — to your security officer, your procurement team and your auditors.
The essentials
Our guarantees, in plain language
Hosted in Canada
Data, files, memories and AI processing stay in the AWS Canada region. Only the public interface assets go through the global delivery network.
One environment per customer
Each customer gets its own environment: storage, memory index, knowledge base, AI filters and access roles. One customer reaching another’s data is impossible by design.
Encrypted everywhere
AES-256 at rest with AWS KMS-managed keys. TLS 1.2 or higher in transit, with HSTS.
Identity and access
SAML single sign-on with your identity provider, fine-grained roles and permissions, confidential requests limited to authorized people.
Scanned files
Every uploaded file is scanned for malware before it is processed.
Continuous monitoring
Tamper-proof audit logs, threat detection and continuous configuration compliance checks.
Security program
A program structured on NIST CSF 2.0
Our information security program follows the NIST Cybersecurity Framework 2.0 across its six functions: govern, identify, protect, detect, respond and recover. It targets SOC 2 Type 2 equivalence, self-assessed against the same criteria.
- System security plan covering all six framework functions.
- Policies: access, data protection, secure development, incidents, vendors, AI use.
- Risk register reviewed every quarter.
- Incident response and disaster recovery plans.
- Compliance evidence collected automatically from AWS.
- AI processing in Canada, through Amazon Bedrock.
- Only approved models can be called.
- A prompt-injection filter on every call.
- Your data is not used to train models.
Procurement
We make it easy
Security questionnaires
We complete your security questionnaires and vendor assessment grids.
Documentation under NDA
Security plan, policies and NIST control mapping, on request.
Reversibility
Your data belongs to you. You can retrieve it at any time, in standard formats.
Does your security team have questions?
Request our security package or a meeting with our technical team.