Security

Your data stays apart

Everything you and your colleagues do in the Strategy Agent belongs to your Tenant, your company’s own space on the platform. Every request is checked against the Tenant it belongs to, so no one can read or change another company’s data.

Inside your Tenant, Roles decide who may do what. Your Tenant’s admins give them to users and Groups.

Signing in

Users sign in through Amazon Cognito, in the EU, with a password or through their company’s own identity provider (SAML or OIDC). Everyone who signs in with a password can add two-step verification with an authenticator app, and your Tenant’s admins can require it of all of them.

Your admins can verify your company’s email domains, so that its users find the right Tenant and sign-in. To check a domain, we look up a TXT record in its public DNS. The lookup holds only the domain’s name.

Access by our staff

Authorised staff of Scavenger AI access your data only as far as support, operation and security of the platform need it, and to meet legal obligations. They are bound to confidentiality.

Our Super-admins are members of every Tenant, so that support never depends on an invitation. Your admins see them on the Users page, marked Scavenger AI staff. They always sign in with a password and two-step verification, and everything they do in your Tenant is in its Audit Log.

No training on your data

We don’t use your data to train or fine-tune AI models, neither our own nor those of our sub-processors. AI models only answer requests.

Technical and organisational measures

Our measures for confidentiality, integrity, availability and how we check them regularly are listed in Annex 3 of the data processing agreement.

Security incidents

If we suspect a security incident or a breach of the protection of personal data, we inform your company without undue delay, take the measures needed to secure the data, and support your company in its own obligations. The details are in § 6 of the data processing agreement.