Encrypted transport
Phaseo's public service is delivered over HTTPS. Requests are forwarded to model providers over encrypted HTTPS connections.
Self-attested
Phaseo Trust Centre
Security and trust at Phaseo
Current product safeguards, data practices, and assurance status. Claims on this page are limited to what Phaseo can support today.
- Assurance
- Self-attested
- Assurance
- Last reviewed 30 August 2026
Trust documents
Use the detailed material for security review, vendor assessment, or DPA discussion.
Security whitepaper
Architecture, data flows, current safeguards, limitations, and customer responsibilities.
Self-attested
Subprocessors
Core infrastructure, conditional processors, and customer-directed third parties.
Public schedule
Data Processing Addendum
A non-binding first draft for UK and EU controller-to-processor review.
Legal review required
Security
Product and operational safeguards supported by current code and documentation.
Provider key protection
Bring-your-own provider credentials are encrypted with AES-256-GCM before storage. API, management, and OAuth secrets use one-way HMAC or password-based derivation before storage.
Self-attested
Scoped access and OAuth
Workspace roles and scoped API or OAuth permissions limit access. OAuth connections show their requested permissions during consent and can be revoked.
Available
Enterprise identity
SAML single sign-on and SCIM user and group provisioning are gated by workspace entitlements and feature flags; they are not available to every account.
Gated
Private vulnerability reporting
Reports can be submitted through GitHub Security Advisories or security@phaseo.app. Phaseo targets acknowledgement within three business days.
Available
Data handling
How gateway content is handled by default, where exceptions apply, and what remains provider-dependent.
Gateway content by default
Raw prompts and full outputs are excluded from Phaseo's primary request database and analytics. Eligible non-streaming outputs may be cached in Upstash for five minutes by default, or up to 24 hours under a configured cache policy.
Self-attested
Private I/O logging
A feature-gated workspace setting can store requests, responses, and optional provider payloads in private Cloudflare R2 for 90, 180, or 365 days. It is off by default.
Gated
Optional data contribution
This is opt-in. Eligible prompts and completions may be redacted and retained for no more than 30 days. Revoking consent stops new capture and queues previous captures for deletion.
Available
Provider retention and training
Phaseo cannot promise zero data retention across every model provider. Downstream handling follows the provider and route you use; review the provider policy before sending sensitive data.
Self-attested
Regional routing
Provider and geography controls can constrain eligible routes, but Phaseo does not currently promise end-to-end data residency for every request.
Gated
Service providers
Categories disclosed in Phaseo's current privacy policy.
| Provider | Purpose | Data involved |
|---|---|---|
| Cloudflare and Vercel | Host, secure, and deliver the service | Service traffic, request content in transit, and operational metadata needed to run Phaseo |
| Supabase | Database and account infrastructure | Account, workspace, configuration, and request metadata |
| Upstash | Short-lived response caching | Cached model outputs, workspace-scoped cache keys, and response metadata |
| Stripe | Payments and billing | Billing identity and transaction records; Phaseo does not store full card details |
| Analytics and feature providers | Product analytics, feature delivery, and error diagnosis | Page, device, identity, and usage telemetry; raw gateway prompts and outputs are excluded |
| Email and support providers | Service communications and customer support | Contact details, message or ticket contents, and related account context |
| Model providers | Process the inference request you route | Inputs, outputs, and necessary request metadata; provider terms and retention apply |
| Connected assistant providers | Return authorised OAuth tool results | Only the read-only result and scopes approved through the consent flow |
See the dated subprocessor schedule for named vendors, conditions, location gaps, and the separate treatment of customer-selected AI providers.
Availability and incidents
Service status
Current health and incidents are published at status.phaseo.app. Phaseo does not claim a contractual public uptime SLA.
Incident response
Operational code includes incident notification and outreach paths. Internal playbooks are not public, and the process has not been independently tested.
Compliance
Phaseo does not currently hold an independent security certification. The public DPA is a non-binding first draft and the security whitepaper is self-attested. A formal assurance programme may be considered when customer need and budget justify it; no framework or date is committed.
- SOC 2, ISO 27001, PCI DSS, HIPAA, or another independent Phaseo certification
- A completed independent penetration test or published audit report
- A contractual uptime SLA for the public service
- Universal zero data retention or a guarantee that providers do not train on request data
- Guaranteed regional data residency for every provider and route
- A legal opinion or automatically executed DPA from the public first draft
Responsible disclosure
Report security issues privately. Do not access other people's data, run denial-of-service tests, or disclose a vulnerability before a fix is available.