Security.

This policy applies to Captain as we operate it today and to every deployment model we offer. Where you hold a signed agreement with us and the two differ, the agreement controls.

• The Captain API and the dashboard, on every plan, free through Enterprise.
• Captain's managed cloud, where every tenant runs inside its own isolation boundary.
• Every dataset indexed through either surface: source files, derived embeddings and the query logs that sit alongside them.

Not covered: third-party tools you connect on your own account. Once data leaves Captain for a service you authorised, that service’s terms govern what happens to it.

We index your content. We do not train on it. Customer data is never used to build, fine-tune or evaluate a shared model, and it is never pooled with another customer’s corpus.

Content is processed for exactly two purposes: producing the embeddings and search indices that make retrieval work, and returning the results you asked for. Delete a collection and its index goes with it: the vectors, the extracted text and the cached page renders, in the same operation.

Every byte is encrypted on the wire and on disk, with no plaintext hop in between, including the hops between our own services.

• TLS 1.3 for all traffic, terminated at the edge and re-established internally.
• AES-256 at rest across object storage, block storage, backups and index shards.
• Keys are rotated on a fixed schedule and held in a dedicated KMS. Customer-managed keys are available on Enterprise.

SSO and MFA are mandatory for every Captain employee and contractor. There are no shared credentials, and nobody holds standing access to production.

Production access is role-scoped, time-bound and logged: an engineer requests the role the task needs, the grant expires on its own, and every action taken under it is written to an audit trail we retain for twelve months. Roles are reviewed quarterly and revoked the day somebody changes team.

Each tenant is logically isolated: separate index namespaces, separate storage prefixes and separate keys, enforced at the service layer rather than by convention. You pin your data to a region, US or EU, and it does not leave it.

For the strictest environments we ship a full BYOC deployment: Captain runs inside your own cloud account, on your own network, and nothing but licence telemetry ever leaves it.

Captain runs multi-zone with continuous backup and point-in-time restore. Recovery is rehearsed rather than assumed.

• Recovery point objective: 15 minutes.
• Recovery time objective: 4 hours.
• Restore drills run twice a year against production-sized data, and their results feed the next audit window.

Live and historical availability is published on the status page, and incidents are posted there before they are resolved rather than after.

Security engineering is on call 24/7. Every alert is triaged within one hour of detection and a named incident commander owns it until it closes.

If we confirm a breach affecting your data we notify you within 72 hours with what we know, what we have already done, and what you need to do. A written post-incident review follows within ten business days, whether or not you ask for one.

You control the lifecycle of everything you send us, and nothing outlives the schedule below.

• Content is deleted within 30 days of a delete request or of account closure.
• Backups purge on their own 35-day cycle; nothing survives past it.
• Export runs through the API for as long as the account is open, returning the files you supplied plus the metadata we derived.

Background checks are run wherever local law allows. Everyone completes security training at onboarding and again every year, and confidentiality obligations survive the end of employment. Access is granted on the first day it is needed and removed on the last.

Security is shared. Three things sit on your side of the line.

• Keep API keys secret, scope each one to a single workload, and rotate them on a schedule you set.
• Use SSO and role assignment for your own team rather than one key passed around.
• Tell us at the address below the moment you think a key is exposed. We will revoke it with you on the call.

Material changes are announced 30 days before they take effect, by email to account owners and on the changelog. The version and date at the top of this page are authoritative; earlier versions are available on request.