Version: 3.8 Date: 2026.01.18 Audience: Technical Users, Security Officers, Compliance Teams

Sapience is designed from the ground up with enterprise-grade security and compliance in mind. Our platform provides:

This document provides technical details on how Sapience protects your sensitive company data while enabling powerful AI-assisted workflows.

The Health Insurance Portability and Accountability Act (HIPAA) establishes requirements for protecting sensitive patient health information. Sapience addresses all key HIPAA requirements:

BAA Available: Business Associate Agreements are available for healthcare organizations requiring formal HIPAA compliance documentation.

The General Data Protection Regulation (GDPR) governs data protection and privacy in the European Union. Sapience provides full GDPR compliance:

GDPR-Specific Features:

All data stored by Sapience is encrypted using industry-standard algorithms:

Key Management:

All network communication is encrypted using TLS/SSL:

Certificate Management:

Sapience implements a hierarchical role-based access control system that ensures users can only access resources appropriate to their role:

Role Definitions:

Beyond roles, Sapience supports fine-grained permissions that can be assigned independently:

Agent Permissions:

Feature Permissions:

Permission Levels:

All resources in Sapience are scoped to control visibility:

Scope Types:

Every action in Sapience is logged with complete context:

Tracked Events Include:

Audit Log Retention:

All Sapience objects maintain a complete version history:

Sapience uses a message bus architecture for reliable event processing:

Sapience makes a binding commitment: We never train AI models on your data.

Contractual Protection: This commitment is included in our service agreements and can be verified through our audit trails.

Multiple layers prevent data from leaving your organization:

Tenant Isolation:

Network Security:

Application Security:

Data Loss Prevention:

Sapience offers fully-managed deployments on major cloud platforms:

Why Managed Deployments are Recommended:

For organizations requiring complete control, Sapience can be deployed entirely within your infrastructure:

Deployment Artifacts Provided:

Sapience operates globally with deployments across multiple continents:

Cloud Platform Experience:

In addition to the core security framework describe above, managed Sapience deployments have an additional layer of protection from Cloudflare’s Web Application Firewall (CWAF). The CWAF sits in front of your deployment and inspects every HTTP/HTTPS request, blocking malicious traffic while letting legitimate users through. It focuses on application‑layer attacks (like those against forms, logins, APIs), rather than low‑level network traffic. Core purpose: 1. Protects your deployment and the Sapience APIs from common web attacks such as SQL injection, cross‑site scripting (XSS), remote file inclusion, and other OWASP Top 10 threats. 2. Acts as a shield between your deployment and the internet, filtering requests before they reach our servers. How it works: 1. CWAF Inspects each request in real time and compares it against managed rulesets and known attack patterns; suspicious requests are blocked, challenged, or rate‑limited. 2. Uses both signature‑based detection and machine‑learning‑driven detection to catch known exploits and new variations of attacks. Key protections: 1. Managed rules maintained by Cloudflare are continuously updated to cover new vulnerabilities and zero‑day threats. 2. Custom rules let you/us to collectively enforce your own custom logic based on IPs, countries, paths, headers, methods, user agents, etc., including advanced rate limiting for abuse and DDoS‑style behavior at the application layer. Account safety and data protection 1. Exposed credential checks and related features help detect and block account takeover attempts using stolen usernames and passwords. 2. Sensitive data detection and response controls help prevent leakage or abuse of confidential information in your application responses. What this means for our users (you): 1. Your traffic is routed through Cloudflare’s global edge network, which filters bad requests and absorbs attacks with minimal added latency. 2. As a result, your Sapience instance stays available and responsive even during attacks, and your users’ accounts and data are significantly better protected from common web threats

When using Sapience with sensitive data, we recommend:

For Administrators:

For Users:

For Developers (API Integration):

Q: Is Sapience SOC 2 certified? A: Yes, our managed cloud deployments operate on SOC 2 Type II certified infrastructure. We rely on our vendors for this (Microsoft, Amazon, Google), but pay a premium to ensure it’s true.

Q: How quickly are security patches applied? A: Critical vulnerabilities are patched within 24 hours. Regular security updates are applied weekly.

Q: Who can access my data? A: Only authenticated users with appropriate RBAC permissions can access your data. Sapience support staff cannot access customer data without explicit permission and audit logging.

Q: Is my data used to train AI models? A: No. We never train any AI models on customer data. Your data is used only to provide the service you requested.

Q: What happens to my data if I cancel? A: You can export all your data before cancellation. After a configurable retention period (default 30 days), all data is permanently deleted.

Q: Can Sapience be used for HIPAA-covered data? A: Yes, with appropriate configuration and a signed BAA. Contact us for healthcare-specific deployments.

Q: Is Sapience GDPR compliant? A: Yes. We support all GDPR requirements including data portability, right to erasure, and EU data residency.

Q: Can I get a Data Processing Agreement (DPA)? A: Yes, we provide standard DPAs and can accommodate custom requirements for Sapience Enterprise customers.

Q: Can I run Sapience entirely on-premises? A: Yes, Sapience can be deployed on any Docker-compatible infrastructure, including air-gapped environments. This is our Sapience Private Cloud product offering. Please note that it requires a managed services contract with us.

Q: What cloud providers do you support? A: We currently operate on Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). Other cloud providers can be supported for on-premises deployments. The only “hard” requirement is the ability to run Docker containers, ideally in a Kubernetes clustered environment.

Q: Can I choose my data residency location? A: Yes. For Sapience Enterprise customers, we offer deployments in the US, EU, Australia, UAE, and Saudi Arabia. Additional regions can be provisioned upon request. Lower tiers get routed to infrastructure at our election based on our global footprint and workload at the time of on-boarding.

For security-related inquiries, please contact:

For security vulnerabilities, please report responsibly to: security@sapience.ai

Document Version: 3.8 | Last Updated: 2026.01.18 | Classification: Public