Production infrastructure is designed for EU regions. Model processing is EU by default; an approved Global model route is labelled explicitly and bound to one immutable release. Live hosting and subprocessor evidence will be published before GA.
Trust centre
Security is a boundary you can inspect.
Sourceform is built so authorization, source provenance, and delivery evidence remain visible. This page separates controls implemented in the repository from deployment and assurance work still required before general availability.
Product policy prohibits using tenant content to train Sourceform or provider models.
The Answer Runtime sends only authorized evidence and exposes no tools. The private gateway uses code-owned HTTPS provider origins; network-level egress proof remains an open live gate.
What the product enforces.
These controls are implemented and tested in repository code. They are not described as live production controls until the signed staging and production deployment gates pass, and they are not substitutes for legal assessment or certification.
Tenant isolation
Implemented in code · live gate openTenant scope comes from authenticated identity and membership. Client-supplied tenant identifiers are never trusted.
Default-deny authorization and tenant-scoped persistenceEvidence-preserving answers
Implemented in code · live gate openRetrieval results retain original evidence and are reauthorized before any model egress.
Exact source versions, locators, and immutable deploymentsFail-closed delivery
Implemented in code · live gate openProvider or verifier failure produces no uncited answer. Abstentions and failures are not billed as verified answers.
Explicit answer outcomes and verifier publication gatesAudited operations
Implemented in code · live gate openSensitive support and platform operations require an authenticated actor and create evidence for review.
Trace IDs, immutable release references, and operation recordsData lifecycle
Retention is selected. Deletion is tracked.
Conversation content can be retained for 0, 30, or 90 days. Export and deletion are explicit account operations; deletion is designed to propagate across primary storage, object storage, indexes, semantic data, graph data, and cache.
- 01Collect minimallyOnly content needed for an answer or consented handoff.
- 02Retain deliberately0, 30, or 90 day conversation-content settings.
- 03Delete with evidenceTracked propagation rather than a silent UI disappearance.
What we will not overclaim.
Scope, remediation evidence, and retest must be complete.
GDPR and AI Act positioning, contracts, and notices require qualified counsel review.
Sourceform does not currently claim ISO 27001, SOC 2, or other third-party certification.
Need the detail?