Xybern builds reasoning AI for regulated law and finance teams. This policy describes what data we collect, how we use it, and the controls available to your organization.
Last updated: March 2025
We collect the minimum data required to operate the Assistant, Deep Research, Projects, and compliance features.
Customer Data is used to deliver the Services, power reasoning chains, surface citations, run compliance checks, provide support, and detect abuse. Aggregated metrics help us plan capacity and improve inference quality, but prompts and uploads remain scoped to your workspace unless you explicitly share them.
Depending on your configuration, prompts may be processed by multiple reasoning models (first-party or contracted LLM providers) to achieve consensus. Providers only receive the minimum text needed for the request, under agreements prohibiting training on your data.
Data is encrypted at rest and in transit. You may request dedicated environments, EU/US residency, customer-managed keys, or private networking. Access is restricted by role-based controls, hardware security tokens, and continuous logging.
We leverage audited infrastructure and carefully-vetted vendors. Your admin team can request the full list during diligence.
We do not sell personal data or permit advertising technology inside Xybern. Subprocessor changes are communicated to admins with opt-out options consistent with your agreement.
Customer Data remains in your workspace until you delete it or your agreement ends. After termination, we retain backups for up to 30 days (unless law requires more) solely for disaster recovery, then purge them using certified deletion procedures.
Admins can export Projects, Deep Research runs, audit logs, and connector inventory through the product or by contacting support. You can request confirmation about where your data is stored and how it is segmented.
Depending on where you live (EU/EEA/UK, California, etc.), you may request access, correction, deletion, portability, or restriction. Email info@xybern.com and we will respond within the timelines required by applicable law.
Xybern is not directed to children under 16 and we do not knowingly collect their personal data.
Contact info@xybern.com or your account team for tailored terms, data residency commitments, or copies of penetration and compliance reports.
