Security and Trust

1. Architecture Overview

Palette is a cloud-native platform built on a major cloud provider. The platform is designed as a multi-tenant service with strict logical separation between customers. Workloads run in hardened, isolated environments, and we follow the principle of least privilege across our infrastructure.

We minimize the data each component can reach. HR data, application logic, and AI processing are separated so that no single component holds broad access by default.

2. Encryption

All data is encrypted in transit using TLS 1.2 or higher. Data at rest is encrypted using AES-256 or equivalent. Encryption keys are managed by our cloud provider's key management service, with rotation and access controls in place.

3. Authentication

We support enterprise single sign-on through SAML and OIDC, so customers can manage access using their own identity provider. Multi-factor authentication is supported and can be enforced. Sessions are time-limited, and we follow current best practices for credential storage.

4. Authorization and Permissions

Access within a workspace is governed by role-based access control. Administrators define roles and grant the minimum access each person needs. Permissions are enforced consistently across the user interface, the API, and AI agents, so an agent can never reach data or actions that the requesting context is not authorized for.

5. Tenant Isolation

Each customer's data is logically isolated and scoped to that customer's workspace. Every request, including requests made by AI agents, carries the tenant context, and our data access layer enforces that scope on every query. This prevents one customer's data from being exposed to another.

6. AI Security Controls

AI agents operate inside the same permission boundary as the people they act for. Specifically:

• Agents only access data the requesting user or workflow is authorized to see, enforced at the data layer.
• Prompts and context are processed to generate outputs and are not used to train public foundation models.
• Model providers receive only the data needed for a given task, under contracts that prohibit training on it.
• Agent actions are logged and attributable, and sensitive actions can require human approval.

7. Logging and Monitoring

We maintain audit logs of significant events, including authentication, permission changes, data access, and agent actions. Security-relevant logs are monitored for anomalies, and customers can access audit logs for activity in their own workspace.

8. Backups and Disaster Recovery

Customer data is backed up regularly, and backups are encrypted. We maintain a disaster recovery plan with defined recovery objectives, and we test our ability to restore service and data. Infrastructure is deployed across redundant availability zones to reduce the impact of localized failures.

9. Vulnerability Management

We patch and update systems on a regular cadence and prioritize fixes based on severity. We use automated dependency and vulnerability scanning, and we engage independent parties for periodic penetration testing. We welcome responsible disclosure of security issues at the contact below.

10. Incident Response

We maintain an incident response plan that defines roles, severity levels, and escalation paths. If we become aware of a security incident affecting customer data, we investigate promptly, take steps to contain and remediate it, and notify affected customers without undue delay and consistent with our contractual and legal obligations.

11. Secure Development Lifecycle

Security is built into how we ship. Changes go through code review, automated testing, and security checks before release. We separate development, staging, and production environments, restrict production access, and require strong authentication for engineering systems.

12. Certifications and Roadmap

We are building toward independent certification of our security program. SOC 2 Type II and ISO 27001 are on our roadmap. We will publish updates here as we reach milestones. For current documentation, security questionnaires, or to discuss your requirements, contact us at the address below.

13. Contact

For security questions, documentation requests, or to report a vulnerability, contact us at founders@palettetechnology.com or (408) 889-1158.