Home / Platform / Security & Compliance
Security built into the foundation, not bolted on later.
Most AI platforms started as consumer products and retrofitted enterprise security. GearHead was built from the start for the kind of work small businesses actually do: legal matters, patient records, financial data, contractor agreements. Here is the architecture.
When a solo lawyer, a five-person therapy practice, or a regional contractor uses GearHead, they are putting real client information, real patient context, and real financial data into the system. That responsibility shapes every architectural decision.
GearHead is multi-tenant by design with isolation enforced at the database layer, not just at the application layer. Every memory read and write goes through permission checks. Every integration token is scoped narrowly. Every meaningful action is audit-logged.
For Framework customers, single-tenant deployment options exist for organizations with stricter requirements: dedicated infrastructure, customer-managed encryption keys, regional data residency, and deployment behind your VPC.
What this actually means
Concrete architecture choices, not vague security marketing.
Encryption at every layer
AES-256 at rest, TLS 1.3 in transit. Memory embeddings, document storage, integration tokens, message history. Encrypted before it touches disk. Per-account key derivation. No plaintext shortcuts.
Role-based access at the data layer
Three roles (admin, staff, client), three memory scopes (user, project, company). Permission checks live in the data access layer, not the UI. You cannot bypass them by hitting the API directly.
Multi-tenant isolation
AccountScope enforced at the model layer. Every query is automatically filtered by tenant. No cross-account data leakage possible, even from bugs. Per-account encryption keys add a second isolation layer.
OAuth-scoped integration tokens
Every integration uses narrowly-scoped OAuth tokens. No master credentials stored anywhere. Tokens revocable per-integration without affecting others. Token rotation handled automatically.
Audit trails on everything
Memory writes, sensitive memory reads, integration connections and revocations, permission changes, model invocations on sensitive data. All logged with timestamp, user, and source. Audit-export available anytime.
Data ownership and portability
Your data is yours. Export anytime in standard formats. Delete anytime, and we actually delete it. We do not train our models on your data. We do not sell it. We do not share it with third parties beyond the AI providers required to fulfill your requests.
Technical details
For the technical buyer, the CISO, or the curious.
admin, staff, client). Three memory scopes (user, project, company). Permission checks enforced in the data access layer via AccountScope.Compliance posture
Where GearHead is today on the major frameworks small businesses care about.
HIPAA-aligned architecture
Encryption, audit logging, RBAC, and BAA-eligible integrations. BAAs available for Framework customers. Suitable for therapy, medical office, and care practice work.
SOC 2 Type II
Audit in progress. Target completion Q4 2026. Current controls map to all five Trust Services Criteria.
GDPR-ready
Data subject access requests supported. Right-to-deletion honored within 30 days. EU data residency available for Framework deployments.
Legal / privilege
Per-matter encryption keys, attorney-client privilege scoping, audit trails suitable for discovery preparation. Used by sole practitioners through small firms.
See the product feature: Top-Tier Security
The product feature page covers the user-facing security controls: how to configure permissions, manage tokens, review audit trails, and tune what GearHead retains.
Open the feature page →Get the full architecture brief.
Book a security-focused walkthrough. We will go deep on the architecture, deployment options, and answer questions your CISO would actually ask.