Data Security
We take over your operations, connecting CRMs, inboxes, and financial systems. That demands a security posture you can verify. Here is exactly how we protect your data.
/1.0Encryption
- In transit: all traffic to our systems and to the third-party services we integrate is encrypted with TLS 1.2+. No client data crosses the network in plaintext.
- At rest: stored data and backups are encrypted using AES-256, backed by AWS-managed keys (KMS) on encrypted volumes.
- Secrets: API keys, OAuth tokens, and credentials are encrypted at the application layer with a separate key, never committed to source control, and never logged.
/2.0Access Controls
- Least privilege: we request only the scopes a system needs. We do not ask for blanket admin access when read-only or a single scope will do.
- Role-based access: internal access to client environments is restricted to the people working on that engagement and enforced server-side.
- Authentication: production systems we operate require multi-factor authentication; sessions are short-lived and cookies are Secure, HttpOnly, and SameSite-scoped.
- Isolation: each client's systems run in an isolated environment. Executive Installation clients can be deployed fully on-premise.
/3.0Credential & OAuth Token Handling
When you connect a service such as QuickBooks, Google Workspace, or a CRM, we use OAuth wherever it is offered so you grant scoped access without handing us a password. Tokens are stored encrypted, scoped to the minimum required permissions, refreshed automatically, and revocable by you at any time from the provider's settings, or by us on request. Where a provider only supports API keys, those keys are encrypted at rest and rotated on offboarding.
/4.0Infrastructure
Our managed systems run on Amazon Web Services (AWS), behind Cloudflare. We use encrypted volumes, hardened operating-system configurations, a default-deny firewall posture, and automated security patching. Network access to production is restricted, and administrative access is gated behind MFA. Inheriting AWS's physical and infrastructure security lets us focus on the application layer where client data actually lives.
/5.0Monitoring & Logging
Systems we operate are monitored for availability and anomalous activity. Access and administrative actions are logged. Logs are scrubbed of secrets and sensitive payloads by design. We log events, not the contents of your data. Failed-authentication throttling and intrusion-prevention tooling are in place on production hosts.
/6.0Incident Response
If we become aware of a security incident affecting your data, we will investigate promptly, contain it, and notify you without undue delay with what we know and what we're doing about it. We rotate any potentially exposed credentials, document the root cause, and apply fixes so it does not recur. We coordinate with you on any disclosure your own compliance obligations require.
/7.0Compliance Posture
Fellowship AI is a consulting firm and does not itself hold a SOC 2 certification. We achieve a strong compliance baseline by building on providers that do, most notably Anthropic (SOC 2 Type II, ISO 27001 and ISO 42001, GDPR-aligned, HIPAA-eligible under a BAA) and AWS (SOC 1/2/3, ISO 27001, PCI DSS, HIPAA-eligible). See our AI Usage & Ethics and Data Governance pages for the full picture, including our sub-processor list. A Data Processing Agreement (DPA) is available on request.
Security questions or need documentation for your compliance team? Email [email protected].