Data collection and processing scope
We process customer-submitted content for moderation decisions, account
details required for authentication, and operational metadata such as API
usage metrics. We minimize collection to what is needed to deliver the
service, support abuse detection, and meet legal obligations.
Data storage and access controls
Customer data is segmented by environment and logical tenant boundaries.
Production access is restricted to authorized personnel under least-privilege
policies, enforced with multi-factor authentication, and reviewed regularly.
Administrative actions are logged for auditability.
Encryption in transit and at rest
Data in transit is protected with industry-standard TLS. Sensitive data at
rest is encrypted using managed key services with rotation policies, and
cryptographic controls are reviewed routinely to align with current standards.
Logging and monitoring
We monitor systems for availability, performance, abuse, and anomalous
behavior. Security logs are collected and reviewed to support detection,
investigation, and auditing requirements.
Retention schedules
Moderation content is retained only as long as needed to provide the service,
resolve disputes, and meet regulatory requirements. Usage records are retained
for billing, security investigations, and audit purposes, then deleted or
anonymized according to documented retention schedules.
Incident response
We maintain documented incident response playbooks, escalation paths, and
communication procedures. Customers are notified of reportable incidents in
accordance with contractual and regulatory timelines.
Compliance frameworks
Our security program aligns with applicable privacy and security requirements
such as GDPR and state privacy laws, and we map controls to frameworks like
SOC 2 and ISO 27001 where applicable. We perform periodic risk assessments,
vendor reviews, and security testing to validate control effectiveness.
For security inquiries or to request documentation, contact
security@aimodcon.com
.