Secure, auditable, and compliant by design.
Your context layer holds the institutional knowledge your agents act on. Alchemyst AI treats it like a system of record: scoped at write time, encrypted in transit and at rest, and traceable on every retrieval, so security reviews move as fast as your roadmap.
Last updated: September 2026
- SOC 2
- In progress
- uptime SLA
- 99.9%
- retrievals traced
- 100%
Agents are only as trustworthy as the context they read.
Security compliance is no longer optional. As agents take on real operations, the context layer joins your attack surface and your audit scope. Every fact, rule and decision it serves has to be protected, attributable and removable.
Least access by default
Agents see only the context scoped to them. Nothing is shared across tenants, teams or projects unless you decide it should be.
Every retrieval on the record
Each answer an agent gives can be traced back to the exact context it was served, so decisions are explainable and defensible.
Your context stays yours
We never sell your data. Context is model-agnostic, exportable, and retained no longer than 36 months after account termination.
- SOC 2
- In progress
- Uptime SLA
- 99.9%
- Retrievals traced
- 100%
- Personal data sold
- Never
- Retention after termination
- Max 36 months
- Card payments
- Razorpay, PCI-DSS
- SSO and SAML
- Enterprise
- Dedicated infra, VPC peering
- Enterprise
The frameworks security teams ask about.
Where we stand today on each standard. Status changes as our program matures; request our security documentation for the current detail.
SOC 2
AICPA Trust Services Criteria
Our SOC 2 program is under way: security, availability and confidentiality controls are being mapped to the Trust Services Criteria ahead of an independent audit.
In progressGDPR
EU General Data Protection Regulation
Personal data is processed only with a valid legal basis. Data subjects can access, correct and delete their data, or withdraw consent, at any time.
AlignedDPDP Act
India Digital Personal Data Protection Act, 2023
As an India-headquartered company, we process personal data only for specified purposes and honour the rights of every Data Principal.
AlignedCCPA
California Consumer Privacy Act
We do not sell personal information. California residents can request access to, or deletion of, the data we hold about them.
AlignedISO/IEC 27001
Information security management
Our information security management practices are being structured around the ISO/IEC 27001 control set.
RoadmapHIPAA
US Health Insurance Portability and Accountability Act
Support for teams handling Protected Health Information is on our roadmap. Please do not send PHI to Alchemyst until a BAA is in place.
RoadmapPCI-DSS
Payment Card Industry Data Security Standard
Card payments are handled by Razorpay, a PCI-DSS compliant processor. Card data never touches Alchemyst servers.
Via Razorpay
Security built into the context layer.
The controls that protect your context are part of the platform, not an add-on. They apply to every ingest, every retrieval and every agent.
Encryption in transit and at rest
Traffic to the API, SDKs and MCP server is encrypted over TLS, and stored context is encrypted at rest.
Scoped, isolated context
Context is scoped to its owner at write time, so an agent only ever retrieves what it is entitled to see.
Context Traces
Every retrieval records its sources, scores and the rules applied: a complete record of what each agent knew, and why.
Access control, SSO and SAML
Role-based access controls for your team, with single sign-on through SSO and SAML authentication.
Dedicated infrastructure
Run on dedicated infrastructure with VPC peering when your data cannot share a network boundary.
Export and deletion
Export your context at any time and have it deleted on request. Your context is never locked to one model or vendor.
Compliance made simple, secure and scalable.
Strong controls should speed teams up, not slow them down. Here is what a secure context layer changes day to day.
Reduce risk
Minimize exposure to regulatory fines and data breaches with controls that are on by default, not bolted on after launch.
Pass security reviews faster
Hand procurement a clear posture, documentation and real traces instead of rebuilding answers for every questionnaire.
Keep agents accountable
When an agent acts, show exactly what context it used and why. Debug in minutes and defend decisions with evidence.
Stay ahead of regulation
Our program tracks evolving global standards, so your compliance posture improves without re-architecting your agents.
How Alchemyst keeps your context secure.
Protection follows your data through its whole lifecycle, from the first write to the final audit.
01 · Ingest
Scoped on write
Data arrives over encrypted connections and is scoped to its owner the moment it is written.
02 · Store
Encrypted and isolated
Context is encrypted at rest and isolated per organization, on shared or dedicated infrastructure.
03 · Retrieve
Checked on every call
Each request is checked against its scope before any context is served to an agent.
04 · Audit
Traced end to end
Every retrieval produces a Context Trace you can review, export and hand to your auditors.
Security questions? Talk to the team that built it.
Request our security documentation, start a vendor review, or report a vulnerability. We reply within two business days.
Security review
Get our security overview, policies and questionnaire answers for your vendor assessment.
Request docsResponsible disclosure
Found a vulnerability? Email us with the subject “Security” and give us reasonable time to fix it before public disclosure.
Report an issue