Home / Platform / Security & Compliance

Platform · Security & Compliance

Security built into the foundation, not bolted on later.

Most AI platforms started as consumer products and retrofitted enterprise security. GearHead was built from the start for the kind of work small businesses actually do: legal matters, patient records, financial data, contractor agreements. Here is the architecture.

Sign Up Request a Demo

When a solo lawyer, a five-person therapy practice, or a regional contractor uses GearHead, they are putting real client information, real patient context, and real financial data into the system. That responsibility shapes every architectural decision.

GearHead is multi-tenant by design with isolation enforced at the database layer, not just at the application layer. Every memory read and write goes through permission checks. Every integration token is scoped narrowly. Every meaningful action is audit-logged.

For Framework customers, single-tenant deployment options exist for organizations with stricter requirements: dedicated infrastructure, customer-managed encryption keys, regional data residency, and deployment behind your VPC.

What this actually means

Concrete architecture choices, not vague security marketing.

Encryption at every layer

AES-256 at rest, TLS 1.3 in transit. Memory embeddings, document storage, integration tokens, message history. Encrypted before it touches disk. Per-account key derivation. No plaintext shortcuts.

Role-based access at the data layer

Three roles (admin, staff, client), three memory scopes (user, project, company). Permission checks live in the data access layer, not the UI. You cannot bypass them by hitting the API directly.

Multi-tenant isolation

AccountScope enforced at the model layer. Every query is automatically filtered by tenant. No cross-account data leakage possible, even from bugs. Per-account encryption keys add a second isolation layer.

OAuth-scoped integration tokens

Every integration uses narrowly-scoped OAuth tokens. No master credentials stored anywhere. Tokens revocable per-integration without affecting others. Token rotation handled automatically.

Audit trails on everything

Memory writes, sensitive memory reads, integration connections and revocations, permission changes, model invocations on sensitive data. All logged with timestamp, user, and source. Audit-export available anytime.

Data ownership and portability

Your data is yours. Export anytime in standard formats. Delete anytime, and we actually delete it. We do not train our models on your data. We do not sell it. We do not share it with third parties beyond the AI providers required to fulfill your requests.

Technical details

For the technical buyer, the CISO, or the curious.

Encryption at rest
AES-256-GCM for all stored data including PostgreSQL data, memory embeddings, document storage, integration tokens. Per-account key derivation. Cloud KMS for master key management.
Encryption in transit
TLS 1.3 for all client-server and service-to-service communication. HSTS enforced. Certificate pinning for sensitive integrations.
Authentication
Email + password with bcrypt hashing, plus optional SSO via Google Workspace and Microsoft 365. MFA available for all accounts. SAML SSO for Framework deployments.
Authorization model
Three role tiers (admin, staff, client). Three memory scopes (user, project, company). Permission checks enforced in the data access layer via AccountScope.
Audit logging
Every memory write, sensitive memory read, integration connection, revocation, permission change, and model invocation logged with user ID, timestamp, source, and outcome. Retention: 7 years on paid plans.
Integration security
OAuth 2.0 with narrowly-scoped tokens for all 38+ integrations. Tokens encrypted at rest. Automatic refresh. Revocable per-integration. No master credentials.
Data residency
US-based hosting by default (AlmaLinux on dedicated VPS infrastructure). Framework deployments support regional residency including EU and customer-controlled regions.
Backup and recovery
Encrypted daily backups with 30-day retention on paid plans. Point-in-time recovery available. Disaster recovery RPO: 1 hour. RTO: 4 hours.
AI provider data handling
GearHead routes through enterprise APIs from Anthropic, OpenAI, Google, and others. These providers contractually do not train their models on API data. No data crosses provider boundaries within a single request.
Deployment options
Shared multi-tenant (default, all plans). Single-tenant dedicated (Framework customers, customer-managed encryption keys, dedicated infrastructure). VPC-isolated (Framework, behind your network perimeter).

Compliance posture

Where GearHead is today on the major frameworks small businesses care about.

HIPAA-aligned architecture

Encryption, audit logging, RBAC, and BAA-eligible integrations. BAAs available for Framework customers. Suitable for therapy, medical office, and care practice work.

SOC 2 Type II

Audit in progress. Target completion Q4 2026. Current controls map to all five Trust Services Criteria.

GDPR-ready

Data subject access requests supported. Right-to-deletion honored within 30 days. EU data residency available for Framework deployments.

Legal / privilege

Per-matter encryption keys, attorney-client privilege scoping, audit trails suitable for discovery preparation. Used by sole practitioners through small firms.

Get the full architecture brief.

Book a security-focused walkthrough. We will go deep on the architecture, deployment options, and answer questions your CISO would actually ask.