Your bids, contracts and sub proposals stay on US infrastructure, isolated per customer, and are never used to train AI models. Our compliance program is underway, starting with the SOC 2 Type II audit, and the readiness summary is available under NDA.
Three rules apply on every plan.
Storage and inference run on US infrastructure, primary region us-east-1, with failover inside the United States.
Your documents and outputs never train BAU AI models or any third-party model. Foundation models run under enterprise terms that prohibit retention beyond the request. This is a contract term.
No one at BAU AI reads customer documents in normal operations. Support access is opt-in, time-bound, and logged. Nothing is shared with ad networks or data brokers.
These run now, on every plan, without waiting for the audit report.
Each customer's documents are processed and stored in a logically isolated environment. Cross-tenant access is blocked at the data, application, and audit-log layers.
All storage is encrypted with tenant-specific keys.
Least-privilege roles, with privileged access reviewed quarterly. Every action is logged with user, time, document, and citation.
You set retention, from 30 days to indefinite. Backups are encrypted and aged out per your policy.
Our SOC 2 Type II audit is underway. SOC 2 is an attestation report, not a certification. When you compare vendors, ask each one for the report itself, its type, and the period it covers.
Procurement, IT, and counsel get written answers, not a slide deck.
Request the security packetEmail it, or your list of questions, to tushar.adsul@bauai.co.
The SOC 2 readiness summary and compensating controls, plus the sub-processor list.
We answer in writing, usually within one business day.
Agents do the first pass. The decision to bid, sign, or award stays with a person.
Each finding traces to the document, section, clause, and page.
Agents do not follow instructions embedded in documents, and tool use is gated by allow-lists. Low-confidence reads surface as questions, not silent guesses.
Every finding can be edited, dismissed, or overridden, and overrides are logged. No autonomous bid submission, contract signing, or award.
For owner-driven, federal-adjacent, and large general contractor work with stricter infosec requirements.
Request Enterprise pricingA dedicated deployment with its own resources and database, separate from other customers.
Runs in your cloud account or on your infrastructure, with customer-managed keys and inference.
A DPA is part of every Enterprise agreement.
No. Your documents and outputs never train BAU AI models or any third-party model. Foundation models are used under enterprise terms that prohibit retention beyond the request.
In the United States. US tenants run on US infrastructure, primary region us-east-1, with US-only storage and inference. Bid data does not move across regions.
The audit is underway and covers the Security, Availability, and Confidentiality criteria. Until the report is issued, we share a readiness summary and a description of active compensating controls under NDA. SOC 2 is an attestation, not a certification.
Yes. Send it to tushar.adsul@bauai.co and we answer in writing, usually within one business day. Supporting documents are shared under NDA.
SSO runs on SAML 2.0 or OIDC, and SCIM provisioning works with Okta, Microsoft Entra, and Google Workspace. Both are included on higher plans; the pricing page shows which.
Yes, on Enterprise. A dedicated single-tenant deployment in your cloud account, or on-premise with customer-managed keys and inference, keeps data, keys, and the model boundary inside your infrastructure.
Inputs are treated as untrusted. Agents do not execute instructions embedded in documents, tool use is gated by allow-lists, and outputs are scoped to the calling tenant. Citations are checked against the source before a finding is shown.
You export your data, findings, and audit trail in machine-readable formats. We hard delete on request and confirm it in writing within 30 days.
Security review
Send your questionnaire. Written answers, usually within one business day.
Looking for the full, legally binding privacy policy?