AI Data Policy
Control whether AI is disabled, private-only, enterprise-approved or supplied through a client API key.
Read AI policy →TRUST CENTER
Security, privacy and AI governance you can inspect.
Centralized controls for encryption, AI processing, retention, access, auditability, data residency and enterprise assurance.
Encryption in transitTLS required
Production databasePostgreSQL required
AI processingClient configurable
RetentionProject configurable
Malware scanningMandatory in production
Audit logsEnabled
Data retention
Delete after delivery, retain 30/90 days, or apply a client-managed policy.
Responsible disclosure
Security issues should be routed through a documented vulnerability-reporting process.
Editorial review: Tasheel Express Language Operations Team · Last reviewed: 15 August 2026.
Practical guidance
Controls that help choose the right workflow
Files and access
Project files are kept outside the public web root, attachment tokens expire, uploaded files are validated structurally and production deployment requires malware scanning. Role-based access and audit events are built into the application layer.
Encryption and production controls
HTTPS/TLS is expected at the production edge, secure cookies are enabled in production and security headers restrict framing, scripts and cross-origin behavior. Credentials and live secrets are intentionally not bundled with the release package.
AI governance
Projects can disable AI or select a controlled processing route. The privacy mode, retention preference and data-region preference are captured during intake so the handling model is visible rather than implicit.
Enterprise due diligence
Security questionnaires, NDAs, data-processing requirements, subprocessor information, incident procedures and business-continuity evidence should be handled as documented procurement artifacts. We publish only controls that are actually implemented or can be evidenced.