Trust Center
For detailed information about our security practices, compliance certifications, and policies, visit our Trust Center:AstroBee Trust Center
View our security documentation, compliance reports, and policies
- SOC 2 Type II compliance status and reports
- Security policies and procedures
- Subprocessor list
- Data Processing Agreement (DPA)
- Penetration test summaries
Security Overview
Data Encryption
| Layer | Protection |
|---|---|
| In Transit | TLS 1.3 encryption for all data transfers |
| At Rest | AES-256 encryption for stored data |
| Credentials | AES-256-GCM encryption for OAuth tokens and secrets |
Infrastructure
AstroBee runs on secure, SOC 2 compliant cloud infrastructure with:- Isolated compute environments
- Regular security patches and updates
- Network segmentation and firewalls
- DDoS protection
Access Control
- Authentication: Secure passwordless authentication and OAuth providers (Google)
- Authorization: Role-based access control (Admin, Member)
- Sessions: Secure session management with automatic timeouts
- API Access: OAuth 2.0 client credentials for programmatic access
Data Handling
Your Data Stays Yours
- AstroBee queries your data sources but does not permanently store your raw data
- Query results are cached temporarily for performance, then purged
- Conversation history is retained for your convenience and can be deleted anytime
- Enterprise customers can use Bring Your Own Bucket (BYOB) for complete data control
Data Processing
- All data processing occurs in secure, isolated environments
- AI features use API-only integrations with no data retention by AI providers
- Your data is never used to train AI models
Data Retention
| Data Type | Retention | Deletion |
|---|---|---|
| Chat conversations | Until you delete | Self-service in app |
| Data layer definitions | Until you delete | Self-service in app |
| Uploaded files | Until you delete | Self-service in app |
| Audit logs | 90 days | Automatic |
Third-Party Integrations
AstroBee uses trusted partners for specific functionality:Fivetran (Data Connectors)
External data source connections (Google Sheets, Salesforce, HubSpot, etc.) are powered by Fivetran, a SOC 2 Type II certified data integration platform.- Data flows: Source → Fivetran → AstroBee Warehouse
- All transfers encrypted in transit
- Fivetran does not retain your data after sync
- View Fivetran’s security practices
AI Providers
AstroBee uses leading AI providers for natural language processing:- API-only integration (no data retention)
- Your data is not used for model training
- Conversations are not stored by AI providers
Reporting Security Issues
If you discover a security vulnerability, please report it responsibly:- Email: security@astrobee.ai
- Response time: We acknowledge reports within 24 hours
Compliance Questions
For compliance documentation, audit requests, or security questionnaires:- Visit our Trust Center
- Contact compliance@astrobee.ai