Version 1.0 · Effective 8 September 2026
This document sets out what PlainPath collects during an engagement, where that information is processed, how it is protected, how long it is retained and what must not be submitted to us. It forms part of our Terms of Service.
It is written to be mapped against an internal AI standard or vendor assessment. Where a question is not answered here, we will answer it in writing on request.
Compass, our audit agent, records the following:
The audit does not collect the following:
The audit requires a description of work, not a sample of it. The following must not be entered:
Prohibited
A description such as "three figures are re-keyed from the client portal into a spreadsheet each month" is what the audit requires. The underlying documents are not.
Where restricted information is submitted in error, notify us and we will remove it from the record and from the next backup cycle.
Model processing. Conversation text is transmitted to Anthropic's commercial API to generate the next question, the process description, the scores and the written report. Anthropic is the only model provider that receives your data.
Under Anthropic's commercial terms, inputs and outputs submitted through the API are not used to train Anthropic's models. Reference: Anthropic Commercial Terms of Service and the Anthropic Privacy Center at privacy.anthropic.com.
Anthropic retains API inputs and outputs for up to 30 days and then deletes them. That period exists for trust and safety review and not for training. Zero Data Retention is not currently enabled on our Anthropic organization. Where an internal standard requires it, notify us during Discovery: it is an account-level arrangement with Anthropic and will be established before any build accesses your systems.
Application processing. The audit runs on software developed and operated by PlainPath, hosted on managed cloud infrastructure. Records are held in a single application database.
Backups. The database is backed up nightly to encrypted object storage. Seven daily, four weekly and three monthly copies are retained.
Correspondence. Report links and notifications are delivered by a transactional email provider. Replies are received through a managed email routing service.
Authorized personnel. Administrative access is restricted to named PlainPath personnel, currently one individual. No shared accounts and no shared credentials are in use.
Authentication. Administrative access requires a hardware-backed passkey with biometric verification. Password authentication to the administrative interface is disabled in production. Automated access uses a single bearer credential held in the hosting environment and is present in neither the database nor the source code.
Session management. Each authenticated session is recorded with a seven-day expiry and a revocation flag. Revocation takes effect immediately and persists across restarts.
Encryption in transit. All requests are served over HTTPS with HSTS. A content security policy blocks inline event handlers, and framing by third-party sites is prohibited.
Encryption at rest. We rely on the volume-level encryption applied by our hosting provider. No additional application-layer encryption is applied to the database file. Backups are held in encrypted object storage.
Report access. Each report is served at a unique high-entropy URL. It is excluded from search indexing and cannot be enumerated. No password is required to open it. Where an internal standard requires authenticated access, we will apply it on request.
Records are retained for the duration of the client or prospect relationship, as Discovery and any subsequent build rely on them. No automatic expiry is currently applied.
Deletion may be requested at any time in writing to [email protected]. On receipt:
We engage a small number of service providers to deliver the audit and subsequent engagements. Their functions are described in section 5: model processing, cloud hosting, encrypted backup storage, transactional email, public web search and payment processing.
Each provider is contractually bound to confidentiality and each holds a SOC 2 Type 2 report or an equivalent attestation. A current list identifying each provider, the data it processes and its attestations is available on request under the confidentiality terms of our engagement, or under a separate non-disclosure agreement where one is preferred.
PlainPath holds no SOC 2 certification and makes no representation to the contrary.
We do not sell data, we do not disclose it for advertising, and we do not use it to develop work for any other client.
The audit is the least intrusive stage. Later stages require more, and each step is agreed in writing before it is taken.
Discovery. Sessions with your personnel, together with exports and samples you elect to provide. Where a sample is required to verify a figure, we request the smallest sufficient extract and ask that it be redacted where possible. Meeting recordings and transcripts are received only where you record them and provide them.
The build. Access to the systems the agent must reach, granted by you, scoped to the process, on accounts you control and may revoke. Read-only access is requested wherever read-only access is sufficient. Where a system provides no compliant means of access, we substitute a controlled interface and record the limitation in the build plan rather than circumventing your controls.
Model requirements. Where an internal policy requires a specific model provider, a specific processing region or a self-hosted model, notify us during Discovery. Such a requirement affects the build plan and the price and is accommodated as a matter of course.
Where we become aware of unauthorized access to your data, we will notify you in writing within 72 hours, stating what is known, the action taken and our recommendation. Notification is not deferred pending a complete assessment.
This document describes our obligations. It does not discharge yours under your own AI standard, your regulator's guidance, or your agreements with your funding bank. Where those requirements are more restrictive than this document, they govern, and we will operate within them. On receipt of the applicable standard we will state where we comply, where we do not, and what compliance would require.
PlainPath
905 Ave K, Lubbock, TX 79401
See also: Terms of Service.