Security Overview

Executive Summary

Slick AI is committed to maintaining the highest standards of security and data protection for our enterprise customers. This document provides an overview of our security architecture, controls, and compliance measures.

Key Security Highlights

• Encryption for all data in transit and at rest
• Per-tenant logical isolation; AES-256 at rest via AWS KMS (HSM-backed), with customer-managed keys (BYOK) available on request
• Regional data residency — EU-West (Ireland) active today
• Zero-retention AI processing where available
• SOC 2 Type II certification in progress (targeted 2026 Q4 / 2027 Q1) (roadmap target; timing subject to auditor capacity and evidence readiness)
• 24/7 security monitoring and incident response
• 99.5% uptime SLA for enterprise customers

1. Security Architecture

1.1 Infrastructure Overview

┌─────────────────────────────────────────────────┐
│                  USERS                          │
├─────────────────────────────────────────────────┤
│            CloudFlare (DDoS/WAF)                │
├─────────────────────────────────────────────────┤
│          Application Load Balancer              │
├─────────────────────────────────────────────────┤
│     ┌──────────┐    ┌──────────┐               │
│     │   API    │    │   Web    │               │
│     │ Gateway  │    │  Server  │               │
│     └──────────┘    └──────────┘               │
├─────────────────────────────────────────────────┤
│     ┌──────────────────────────┐               │
│     │   Application Services    │               │
│     │  (Slickflow Engine, AI)   │               │
│     └──────────────────────────┘               │
├─────────────────────────────────────────────────┤
│  ┌────────┐  ┌────────┐  ┌────────┐           │
│  │Database│  │Storage │  │ Cache  │            │
│  │  (RDS) │  │  (S3)  │  │ (Redis)│            │
│  └────────┘  └────────┘  └────────┘           │
└─────────────────────────────────────────────────┘
           All within AWS VPC

1.2 Multi-Region Deployment

EU-West (Ireland) is the only active region today. US-EAST-1 (Virginia) and ME-SOUTH-1 (UAE) are not currently active; additional regions may be enabled for eligible customers in the future.

1.3 Defense in Depth

We implement multiple layers of security:

1. Network Layer: CloudFlare DDoS protection, AWS Shield
2. Application Layer: WAF rules, rate limiting, input validation
3. Data Layer: Encryption, access controls, audit logging
4. Infrastructure Layer: VPC isolation, security groups, NACLs

2. Data Security

2.1 Encryption Standards

2.2 Data Isolation

Tenant A                    Tenant B
    │                          │
    ├─ Isolated Database       ├─ Isolated Database
    ├─ Separate S3 Prefix      ├─ Separate S3 Prefix
    └─ Unique API Keys         └─ Unique API Keys

  AES-256 at rest via AWS KMS (BYOK available on request)

2.3 Data Retention & Deletion

Conversation data is retained for up to 24 months from the date each message is created, then automatically deleted. Operational and diagnostic logs, which do not contain conversation content, are kept for 30 days. Enterprise and regulated customers may be subject to a different retention period per their agreement, which may be extended to meet record-keeping obligations (for example, financial-services clients subject to regulatory record retention). Users can request erasure of their data at any time.

3. Access Controls

3.1 Authentication

3.2 Authorization Model

Roles (tenant-scoped):
  tenant_admin:
    - Full tenant administration
    - User & role management
    - Configuration & billing

  tenant_user:
    - Day-to-day operations
    - Handle conversations
    - Limited configuration

  viewer:
    - Read-only access
    - Report viewing

4. AI & Model Security

4.1 Model Provider Configuration

Provider applicability is scoped by product and plan. Claude-based tenants use Anthropic via Amazon Bedrock (with Anthropic's direct API and Azure AI Foundry as fallback); OpenAI and Google Vertex AI apply to other products/models.

4.2 Prompt Security

• Input sanitization and validation
• Prompt injection detection
• Output filtering for sensitive data
• Rate limiting per tenant
• Audit logging of all AI interactions

4.3 Embedding & Vector Security

• Per-tenant vector isolation
• Encrypted storage
• Access control at query time
• Regular embedding refresh
• TTL-based expiration

5. Operational Security

5.1 Monitoring & Logging

5.1a Customer Controls & Exports

• AES-256 at rest via AWS KMS (HSM-backed); customer-managed keys (BYOK) available on request
• Audit log export (SIEM-friendly) via API and S3 sinks
• EU-West (Ireland) data residency (US/ME regions not currently active)
• Model provider selection per tenant with zero-retention / non-training options

5.2 Incident Response

Response Team Structure:

Incident Commander
    ├─ Security Lead
    ├─ Engineering Lead
    ├─ Communications Lead
    └─ Customer Success Lead

Response SLAs:

5.3 Business Continuity

• RPO (Recovery Point Objective): < 1 hour
• RTO (Recovery Time Objective): < 4 hours
• Daily automated backups
• Multi-AZ deployment
• Disaster recovery testing quarterly
• Runbook automation

6. Compliance & Certifications

6.1 Current Compliance

6.2 Certifications Roadmap

2026 Q3: ━━━━━━━━━━━━━━━━━━━━┓
         Security Baseline    ┃
                              ┃
2026 Q4: ━━━━━━━━━━━━━━━━━━━━╋━━━━━┓
         SOC 2 Type II Audit  ┃     ┃
         (in progress)        ┃     ┃
2027 Q1: ━━━━━━━━━━━━━━━━━━━━┛     ┃
         SOC 2 Report Targeted     ┃
                                    ┃
2027 Q2: ━━━━━━━━━━━━━━━━━━━━━━━━━━┛
         ISO 27001 Certification (targeted)

6.3 Third-Party Assessments

• Annual penetration testing
• Quarterly vulnerability assessments
• Continuous automated security scanning
• Third-party code reviews
• Supply chain security audits

7. Contact & Resources

Security Contacts

Additional Resources

• Privacy Policy
• Government & Legal Request Procedures (see Section 7.2.1 of our Privacy Policy)
• Terms of Service
• DPA Template
• Sub-processors
• Status Page
• Security Updates