Security at Visalaw

Visalaw AI defines customer data as documents and materials uploaded to the platform by customers. Customer content refers to user prompts and system-generated responses. While these terms are defined separately in Visalaw AI’s contractual agreements, both customer data and customer content are subject to the same confidentiality, security, and data-handling controls under our agreements. They are often discussed together for simplicity.

Visalaw AI protects customer data using industry-standard encryption in transit and at rest, strict access controls, and a default policy of not using customer data for model training. Our security controls are independently validated through SOC 2 Type II audits and are aligned with GDPR, CCPA, and ISO/IEC 42001 principles. These security and privacy obligations are contractually extended to approved subprocessors and external model providers, and customer data is logically separated with access governed by least-privilege controls.

Visalaw AI operates within secure cloud environments designed to meet enterprise security standards. Where supported and contractually agreed, data hosting and processing locations are managed in accordance with customer requirements or applicable regulatory obligations, and these requirements are consistently enforced across Visalaw AI’s approved subprocessors.

Visalaw AI applies role-based access controls and logical workspace separation to ensure that only authorized users can access customer data. Customers determine what data is uploaded, how long it is retained, and how it may be accessed or shared within their organization.

Visalaw AI contractually commits that customer data remains confidential. Under our agreements, customer inputs, outputs, and uploaded materials are not used by Visalaw AI to train, fine-tune, or improve AI models.