1. Your company is separate
Every request is checked against your workspace and the person’s permissions before any data is read or changed. Companies’ data is kept apart from each other.
2. You decide who can do what
The workspace owner invites people and sets what each one can see and do. The crew acts within the same permissions as the person it works for, and what goes live is approved by you.
3. Signing in
Sign-in is protected against automated abuse, and people can add a second step to their sign-in. Sessions can be ended.
4. Where your data lives
BARITA AI runs on Google Cloud. Your company’s records and files are stored in the location you choose. Offered today: United States and Europe, with United States as the default. Other locations are available on request.
- Encrypted in transit: every connection to the service uses HTTPS (TLS), and browsers are told to use HTTPS only.
- Encrypted at rest: stored records and files are encrypted by Google Cloud’s default encryption.
- Recoverable: the company database keeps point-in-time recovery, so records can be restored to a moment within a recent window (currently seven days), and it is protected against deletion. Earlier versions of your apps are kept so you can go back to one.
- Certified infrastructure: BARITA AI runs on infrastructure certified for ISO/IEC 27001 and SOC 2. These are Google Cloud’s certifications, not ours.
- AI work may take place outside the location you chose (see How AI work is controlled).
5. How AI work is controlled
The crew works through tools that check permissions and record what was done, so you can see what happened. Each AI task is given only the content it needs. We choose AI providers whose terms do not allow training on customer content.
The crew may use an isolated work environment to run tools, code and skills, and may search for and read public web pages. The environment can be connected to the internet, so something that has misled the crew could send content from it to the outside. Web pages can contain text written to mislead an AI. Safeguards reduce this risk but cannot remove it. The crew’s tools still check permissions, and what goes live is approved by you.
This work happens on our AI providers’ systems and across the internet, so it can take place outside the location you chose for your data. We make no claim of strict residency for it.
6. Responsible disclosure
We welcome reports of vulnerabilities: write to security@baritaai.com with the details. We will acknowledge and look into every report, and we ask that you give us reasonable time to fix a problem before telling others.