Isolated by customer
Project records, search context, stored artifacts, and approved company knowledge remain scoped to the customer workspace and authorized project.
GAIA Civil security
Your project files stay isolated, encrypted, and out of foundation-model training.
GAIA Civil is designed for proprietary plans, specifications, product knowledge, commercial context, and review rules. The security conversation should show where that information goes, who can reach it, how long it remains, and what still requires a person.
What buyers need to know first
Protect the customer record from intake through handoff.
These are the plain-language commitments. The technical reference holds the implementation and operating detail.
Not used for model training
Customer plans, takeoffs, pricing, product context, and custom rules are processed under enterprise zero-training commitments.
Governed by people
The application can prepare findings and handoffs. Authorized people remain responsible for release, submission, and external action.
Control map
Connect each safeguard to the customer question it answers.
A security review should verify the complete deployed path, not a single service in isolation.
| Area | Documented control | Why it matters |
|---|---|---|
| Access and scope | Authenticated, role-aware access; project and tenant scope checks; least-privilege service paths. | Only authorized users and services can reach the approved customer record. |
| Data in transit | TLS 1.3 across the documented production path. | Project files and application traffic are protected while moving between approved services. |
| Data at rest | AES-256 encryption across the documented production data path. | Stored project sources, records, and artifacts are protected by the approved storage controls. |
| Tenant isolation | Tenant-scoped relational records, dedicated vector collections, and namespaced object paths. | One customer workspace does not become retrieval context for another. |
| AI processing | Enterprise zero-training commitments, real-time inference, and no cross-customer aggregation. | Customer plans, takeoffs, pricing, and custom rules are not used to train foundation models. |
| Actions and release | Human approval gates for external writes, submissions, and customer-facing deliverables. | Prepared work cannot silently become an authorized business or technical decision. |
Security review process
Turn security claims into a decision your team can approve.
Use one shared review across the buyer, security, legal, technical, and operating teams.
- Classify
Define the data involved, its sensitivity, the responsible users, and the decisions the workflow will support.
- Map
Trace the complete path through intake, storage, processing, retrieval, integrations, exports, retention, and deletion.
- Verify
Review the deployed identity, isolation, encryption, model-use, logging, recovery, and approval controls against requirements.
- Decide
Record accepted controls, customer-specific conditions, owners, open actions, and the approval needed before implementation.
Buyer diligence
A focused security review should cover the complete operating boundary.
Use this list to prepare the right technical, procurement, and legal participants.
- Identity, roles, and administrative access
- Tenant isolation and project scope
- Encryption, secrets, and key management
- AI-provider data-use terms
- Logging, audit records, and observability
- Retention, deletion, backup, and recovery
- Integrations, exports, and external actions
- Incident response and customer notification
Security questions
Start with the boundaries that affect your risk decision.
The technical documentation provides the longer operating reference for security and recovery.
Are customer files used to train foundation models?
No. The documented production posture uses enterprise zero-training commitments and does not aggregate customer plans, takeoffs, pricing, or custom rules across tenants.
Can one customer retrieve another customer’s project material?
The architecture separates tenant records through authenticated scope checks, tenant-scoped data, dedicated retrieval collections, and namespaced storage paths. Security review should verify the complete deployed path and the customer’s required identity model.
Can GAIA Civil send, submit, or update an external system by itself?
External writes and customer-facing deliverables remain behind authorized review and approval. Integration permissions and release gates are evaluated as part of implementation.
What should our security team review?
Review identity and access, tenant boundaries, encryption, source and artifact storage, model-provider terms, logging, retention and deletion, backup and recovery, incident handling, integrations, and the human approval path.
Review the real deployment
Bring your data, access, retention, and integration requirements.
We'll map them to the GAIA Civil production path, identify any agreement-specific controls, and give the right reviewers a concrete diligence record.