Trust Center
How Sarga protects customer data, who processes it, and where we stand on audits. We list what is built today and label what is planned.
Updated 2026-11-10
Where we stand
-
SOC 2 Planned
SOC 2 roadmap published. Type I planned. Sarga does not hold a SOC 2 report today.
-
Penetration test Planned
An independent annual penetration test is planned. None has been performed yet.
-
EU AI Act Built
Article 50 provenance marking built. Classification documented.
-
Privacy laws Built
Data-subject tooling built in: erasure, export, rectification and restriction. A Data Processing Addendum is available.
How we protect your data
Hosting
The application and its database run on Railway in the US East region. Vercel serves the web app. All traffic uses TLS.
Tenant isolation
Multi-tenant isolation on shared infrastructure. The server scopes every request to your organisation, and the database also enforces row-level security on customer requests.
Sign-in
Passwords are hashed with bcrypt. Your admins can require multi-factor authentication for privileged roles. Enterprise single sign-on uses SAML or OIDC through WorkOS.
Your AI keys
You bring your own model provider keys. They are encrypted at rest with AES-256-GCM. Only the last four characters are ever shown again.
Audit trail
Governance decisions are signed with Ed25519 and hash-linked. Every audit export includes a verifier your auditor can run on their own machine.
Application security
Rate limits on sign-in and AI endpoints, a strict Content Security Policy and standard security headers. Every code change is scanned for secrets and vulnerable dependencies.
Incidents
If a confirmed breach affects your data, we notify you without undue delay and within 72 hours.
Deletion
Deleting your organisation removes its records, users and stored files.
Sub-processors
Sarga uses seven sub-processors, plus a few services that run only when you turn on a feature that needs them. Model providers you connect with your own keys work for you, not for Sarga.
We post notice of any new sub-processor on the sub-processor page.
Documents
Customers download the Data Processing Addendum, the sub-processor list, the EU SCC and UK IDTA documents, and the CCPA addendum, pre-filled with their organisation's name. They are in Sarga under Settings, Governance & Legal.
Evaluating Sarga? Ask support@sarga.ai for copies.
Contact
Report a security vulnerability to security@sarga.ai. Our disclosure policy is in security.txt.
Everything else, including privacy requests: support@sarga.ai.