Information Security
Your analysis is yours.Full stop.
Caspr is ISO 27001:2022 certified and GDPR compliant. Your uploaded documents never leave Caspr's infrastructure. Your data never trains any model.
Certifications
Independently audited.Not self-reported.
01
"ISO 27001:2022"
Current revision. Independently audited by an accredited external auditor. Certificate available on request to enterprise customers (under NDA). The broadest security standard in scope.
02
"GDPR Compliant"
All user data, EU/EEA scope. Data Processing Agreements executed with all Tier 1 providers. Erasure requests completed within 30 days. DPO contact: privacy@caspr.ai
03
"SOC 2 Type I — Audit in Progress"
Initiated Q2 2026. Report expected Q3 2026. Enterprise customers can access AWS SOC 2 compliance artifacts and current security controls documentation under NDA in the interim.
Data Architecture
Your documents neverleave Caspr's infrastructure.
01
Your uploaded documents — self-hosted
All uploaded files, data room documents, research corpora, and embeddings are processed entirely within Caspr's own AWS infrastructure. No external API calls. No third-party provider exposure.
02
Chat session text — Zero Data Retention
Typed queries and conversation history may be processed by Anthropic, OpenAI, and Google — all under executed Data Processing Agreements with Zero Data Retention on API inputs. Not stored. Not trained on.
03
AES-256 at rest · TLS 1.3 in transit
Every storage layer is AES-256 encrypted. All data in transit uses TLS 1.3. Internal service-to-service communication uses mutual TLS. Enterprise customers can bring their own KMS encryption keys.
Zero Training Commitment
Your data never trainsany model. Ever.
Explicit design decision. All Tier 1 providers (Anthropic, OpenAI, Google) operate under commercial DPAs with zero-retention commitments on API inputs. Self-hosted Tier 2 models run on Caspr-owned compute — no external data transmission. Your data exists to produce your analysis. Nothing else.
Data Retention & Deletion
You control your data.We delete it on request.
90 days
Research queries & outputs
1 year
Uploaded documents (from last access)
0 days
LLM API payloads (Zero Data Retention)
Enterprise Security
"Every enterprise prospect runs a security review. Every one has passed. ISO 27001:2022, zero data retention, and our CTO-led security questionnaire process moves procurement forward without delay."
Joy Sowole
Founder, Caspr
Independent Verification
GDPR compliant.
Certification is not self-reported. An accredited external auditor reviewed the controls. Certificate available to enterprise customers on request.
Your data never trains any model.
Zero Data Retention agreements with all Tier 1 providers. Self-hosted models run on Caspr-owned compute. Your data exists to produce your analysis and nothing else.
Deletion certificate issued.
Every full data deletion request results in a signed, timestamped written certificate. Available on all plans, not just Enterprise.
Frequently Asked Questions
What security certifications does Caspr hold?+
Caspr is ISO 27001:2022 certified and GDPR compliant. ISO 27001:2022 is independently audited — not self-reported. SOC 2 Type I audit is currently in progress (report expected Q3 2026). Certificates and compliance documentation are available to enterprise customers on request.
Is my uploaded data used to train your AI models?+
No. Your uploaded data is never used to train any model. This applies to all tiers of Caspr's architecture. Your data exists to produce your analysis and nothing else.
Does my data leave Caspr's infrastructure?+
Your uploaded documents are processed entirely within Caspr's infrastructure — never sent to an external AI provider. Chat session text may be processed by Anthropic, OpenAI, or Google under Zero Data Retention agreements, meaning it is not stored or used for training.
How long is my data retained?+
Research queries and outputs: 90 days. Uploaded documents: 1 year from last access. LLM API payloads: 0 days (Zero Data Retention). Billing records: 7 years. Enterprise customers can configure custom retention windows via the Admin Console.
What happens to my data when I cancel?+
All your data — reports, uploaded documents, queries, vectors, and backups — is deleted within 60 days of account termination. You can request immediate deletion from Account Settings; that completes within 30 days. Caspr issues a signed, timestamped deletion certificate on completion.
Start Secure
Secure analysisstarts free.
ISO 27001:2022 certified. First $100 gifted. No credit card.
Start Free — your data stays yours