Security Overview

Executive Summary

Slick AI is committed to security and data protection for our enterprise customers. This document provides an overview of our security architecture, controls, and compliance measures.

Key Security Highlights

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Per-tenant logical isolation; AES-256 encryption at rest, with customer-managed keys (BYOK) available for enterprise customers
• EU data hosting (Ireland)
• We use AI providers through their business APIs. Each provider's data handling is listed on our Sub-processors page.
• SOC 2: planned (auditor not yet engaged)
• Automated threat detection (AWS GuardDuty) and audit logging (AWS CloudTrail, AWS Config, VPC flow logs)
• Uptime commitments available in enterprise agreements

1. Security Architecture

1.1 Infrastructure Overview

┌─────────────────────────────────────────────────┐
│                      USERS                      │
├────────────────────────┬────────────────────────┤
│   Website & web chat   │          API           │
│ Vercel, via Cloudflare │     Direct to AWS      │
│   (DDoS, Turnstile)    │ (AWS Shield Standard)  │
├────────────────────────┴────────────────────────┤
│                AWS Load Balancer                │
├─────────────────────────────────────────────────┤
│         ┌──────────────────────────────┐        │
│         │     Application Services     │        │
│         │    (Slickflow Engine, AI)    │        │
│         └──────────────────────────────┘        │
├─────────────────────────────────────────────────┤
│    ┌──────────┐   ┌──────────┐   ┌──────────┐   │
│    │ Database │   │ Storage  │   │  Cache   │   │
│    │  (RDS)   │   │   (S3)   │   │ (Redis)  │   │
│    └──────────┘   └──────────┘   └──────────┘   │
└─────────────────────────────────────────────────┘
  Load balancer and below: AWS VPC (eu-west-1)

1.2 Hosting Regions

Customer data is stored on AWS in Ireland (eu-west-1). AI inference for Claude models runs on Amazon Bedrock in AWS US regions; see Sub-processors.

1.3 Defense in Depth

We implement multiple layers of security:

1. Network Layer: AWS Shield Standard; Cloudflare in front of the website
2. Application Layer: Rate limiting, input validation
3. Data Layer: Encryption, access controls, audit logging
4. Infrastructure Layer: VPC isolation, security groups, NACLs

2. Data Security

2.1 Encryption Standards

2.2 Data Isolation

Tenant A                    Tenant B
    │                          │
    ├─ Tenant-scoped data      ├─ Tenant-scoped data
    ├─ Separate S3 Prefix      ├─ Separate S3 Prefix
    └─ Unique API Keys         └─ Unique API Keys

  AES-256 at rest (BYOK available for enterprise)

Tenants share database infrastructure; isolation is logical (tenant-scoped queries, per-account collections).

2.3 Data Retention & Deletion

Conversation data is retained for up to 24 months from the date each message is created, then automatically deleted. Application logs are kept for 30 days. Enterprise and regulated customers may be subject to a different retention period per their agreement, which may be extended to meet record-keeping obligations (for example, financial-services clients subject to regulatory record retention). Users can request erasure of their data at any time.

3. Access Controls

3.1 Authentication

3.2 Authorization Model

Roles (tenant-scoped):
  tenant_admin:
    - Full tenant administration
    - User & role management
    - Configuration & billing

  tenant_user:
    - Day-to-day operations
    - Handle conversations
    - Limited configuration

  viewer:
    - Read-only access
    - Report viewing

4. AI & Model Security

4.1 Model Provider Configuration

Provider applicability is scoped by product and plan. Claude-based tenants use Anthropic models via Amazon Bedrock in AWS US regions; some Claude models go through Anthropic's API directly, and Azure AI Foundry is a fallback for specific model tiers. OpenAI and Google also process data for specific features (voice-note transcription, image text extraction); see our Sub-processors page. Slick never uses your data to train AI models.

4.2 Prompt Security

• Input validation
• Prompt-injection screening
• Rate limiting per tenant

5. Operational Security

5.1 Monitoring & Logging

5.1a Customer Controls & Exports

• AES-256 encryption at rest; customer-managed keys (BYOK) available for enterprise customers
• Audit log export (CSV/JSON) on request
• EU data hosting (Ireland)
• Model provider selection per contract. We use AI providers through their business APIs. Each provider's data handling is listed on our Sub-processors page.

5.2 Incident Response

Security reports are triaged by our engineering team.

We acknowledge security reports within 48 hours and keep you updated while we triage and fix. Resolution time depends on severity and complexity.

We notify affected customers of a confirmed personal-data breach without undue delay, as GDPR requires.

5.3 Business Continuity

• PostgreSQL runs Multi-AZ with automatic failover
• Automated daily backups of PostgreSQL and DocumentDB, with 7-day point-in-time restore
• Formal recovery objectives (RTO/RPO) and disaster recovery testing are on our roadmap

6. Compliance

6.1 Current Compliance

6.2 Compliance Roadmap

Planned: SOC 2 Type I, then SOC 2 Type II, then ISO 27001. We will publish dates once an auditor is engaged.

6.3 Security Testing

• Automated container-image vulnerability scanning on push (Amazon ECR)
• Automated code, dependency and secret scanning in CI
• Independent penetration test: planned

7. Contact & Resources

Security Contacts

Additional Resources

• Privacy Policy
• Government & Legal Request Procedures (see Section 7.2.1 of our Privacy Policy)
• Terms of Service
• DPA Template
• Sub-processors