Security & Privacy Overview
Jump to a Section
Our secure and resilient AI platform protects your organization’s confidential information.
- Your data is protected with end-to-end encryption in storage and in transit
- We partner with Amazon for best-in-class cloud security
- Our procedures comply with global security standards, including SOC 2 and ISO/IEC 27001
- The AlphaSense network is secured with firewalls and encryption
- Frequent tests and audits maintain our safety standards over time
- LLMs are never trained on customer content, and we exclusively partner with LLM providers that enforce zero data retention policies
✔ AlphaSense complies with industry-leading frameworks including SOC 2 Type 2 compliance and ISO/IEC 27001 certification.
✔ We do regular audits and penetration testing for identifying vulnerabilities through third-party security experts
✔ Personal data, including email and username, are protected in accordance with GDPR regulations
✔ Our daily backup policy guarantees data can be restored if lost
✔ Our emergency protocol ensures preparedness and continuous protection in case of unforeseen events
✔ We constantly assess, evaluate and manage information technology risk, including third-party penetration testing
Your data is protected with end-to-end encryption in storage and in transit
✔ End user communication to AlphaSense servers is done via HTTPS secure web protocol and behind a user-authenticated login process
✔ All user requests are authenticated using one-way encryption against a secure database, and by named servers with specific access keys
✔ Client content is automatically encrypted using Advanced Encryption Standard (AES) 256, a secure symmetric-key encryption standard, using 256-bit encryption keys
✔ Database, search engine and system drives that store user data are directly encrypted
✔ Data is stored with scrambled names mapped to user provided names through a second secure mapping layer
✔ AlphaSense does not harvest user inputs to leverage or sell them to third parties.
✔ LLMs are never trained on customer uploaded data. We work exclusively with LLM vendors who adhere to a strict zero data retention policy.
✔ For Enterprise Intelligence customers, we do not use queries across client-uploaded content to train any models.
✔ Users do not have access to searches or prompts from other customers.
✔ Through Bedrock, we leverage LLMs through a private link, not any public endpoint.
✔ GenAI tools will not editorialize, ensuring less hallucination and higher accuracy.
✔ We have a 98% citation accuracy rate, meaning 98% of the time a result is cited correctly based on its source material.
The AlphaSense platform cannot access users’ private information, such as telephone number, birthdate, address, etc.
Frequent tests and audits maintain our safety standards over time
✔ The entire AlphaSense system is constantly monitored and any access in or out is logged for anomaly detection
✔ Web service uptime at the server level is continuously monitored for any unexpected incidents or high usage suggestive of denial of service attacks
The AlphaSense network is secured with firewalls and encryption
✔ AlphaSense servers are hosted behind a firewall with ingress and egress ports turned off, and are limited to a single HTTPS access on the server catering to user requests
✔ Subsystems are further isolated to Virtual Private Clouds without Internet access, which limits access to only specific named servers within the firewall, and via secure one-way encryption keys
✔ Customer data is physically isolated at rest through the use of dedicated storage when appropriate, and is always logically separated when being indexed and processed.
We partner with Amazon for best-in-class cloud security
✔ Amazon Web Services’ state-of-the-art infrastructure, electronic surveillance, and multi-factor access control systems provide strong protection for users’ data
✔ Amazon’s data centers are staffed 24/7 by trained security technicians, subject to strict background checks, and access is authorized strictly on a privileged basis
✔ Access to servers is protected by multi-factor authentication (MFA) protocols, and user access control is managed by Identity Access Management tools, via secure communication sessions over SSL/TLS
Frequently Asked Questions
AlphaSense is built with a security-first architecture, incorporating encryption at rest and in transit using customer-managed encryption keys (CMEK) to give enterprises full control over their data. AlphaSense enforces strict access controls, continuous monitoring, and secure secret management across all components. The company complies with industry-leading frameworks and certifications such as SOC 2 Type II, and ISO 27001, and supports customer-specific compliance needs including data residency and auditability.
Access and operations
Access to production systems is restricted to authorized personnel based on the principle of least privilege. Access is approval-gated, time-limited where appropriate, and logged for audit purposes.
Data protection
Customer data is encrypted both in transit and at rest using industry-standard encryption. Data in transit is encrypted using TLS 1.2 or higher. Data at rest is encrypted using AES-256.
Trust and compliance
AlphaSense maintains the following third-party security assessments:
• SOC 2 Type 2 attestation
• ISO/IEC 27001:2022 certification
Reports and certifications are available through the AlphaSense Trust Center, subject to NDA where applicable.
PowerPoint & Excel Add-Ins
Workbook reading, editing, assistant orchestration, and local document indexing run on the user’s device. AI reasoning, LLM inference, and AlphaSense research retrieval run in AlphaSense cloud over HTTPS.
SuperAnalyst
Each user session runs inside its own isolated sandbox. The sandbox is a single-container environment that enforces strict limits on what the agent can read, write, execute, and reach over the network. Sandboxes do not talk to each other, and the agent process runs as a restricted, non-root user.
Isolation is enforced at several independent layers: filesystem access is restricted to approved paths, the process runs under a reduced system-call profile and a non-privileged user, and all outbound network traffic is forced through a single controlled proxy that evaluates every connection against an allowlist policy. The code execution capability runs inside this same boundary, so anything the agent executes on your behalf is subject to every one of these restrictions. These controls are enforced independently in the runtime itself, not only in the agent's instructions, so they continue to apply even if the agent is manipulated or behaves unexpectedly. Each layer is designed to hold on its own, so a weakness in one does not collapse the others.
SuperAnalyst MCP
The connector receives only the question and a conversation identifier from the chat client. A new question starts a new conversation, and a follow-up sends the identifier of the earlier conversation. The connector does not receive or read the chat history, attachments, or system prompt, and no client-side context is forwarded to AlphaSense. Files attached in the chat are never uploaded to AlphaSense. Besides the tool arguments, the server receives the user's own access token and standard MCP protocol messages, and it applies the user's saved default filters and preferred model from their AlphaSense account. The question submitted to AlphaSense is processed within AlphaSense to generate the answer and to determine which content to search.
The chat client's model composes the wording of the question, and AlphaSense has no control over it. Users can check exactly what was sent by expanding the AlphaSense tool call in the chat.
