Data Privacy
Privacy of customer data is top of mind. We follow industry best practices and follow all applicable privacy regulations.
Overview
Welcome to Glitter AI's Trust Center. Our commitment to data privacy and security is embedded in every part of our business.
About Glitter AI
Glitter AI makes business process documentation fast and easy. We help organizations turn every process into a step-by-step guide, streamlining operations and improving efficiency.
Our Security Commitment
At Glitter AI, security and privacy are foundational to everything we do. We implement industry-leading security controls and maintain compliance with rigorous standards to protect our customers' data and ensure business continuity.
What You'll Find Here
- Learn about our comprehensive security posture
- Access our security documentation and certifications
- Review our compliance frameworks and attestations
- Understand our data protection and privacy practices
For security inquiries or to request additional documentation, please contact our security team at security@glitter.io.
Compliance
SOC 2 Type II Auditor: GRSee Consulting 
HIPAA BAA available Reports and documents
The SOC 2 report is sent on request SOC 2 Type II report · on request
Subprocessor list · public Data Processing Agreement · public HIPAA and BAA · public Risk profile
Data access level Internal
Impact level Moderate
Recovery time objective 4 hours
Recovery point objective 24 hours
Critical dependence Yes
Third party dependence Yes
Hosting Major cloud provider
See the questions Product security
Data security
Application security
AI
Governance and ethics
Legal
Infrastructure
Frequently asked
Do you train any AI models on customer data? View all 1Security practices
Access Control
Access is tightly monitored and controlled at our company. We are happy to provide more details about our access control practices upon request.
Endpoint Security
We follow industry best practices for endpoint security. We are happy to provide more details about our endpoint security practices upon request.
Network Security
We protect our corporate network against external and internal threats.
Corporate Security
We implement internal measures and practices to maintain a high standard of security.
Policies
Our information security policies are reviewed and approved annually. Please contact us for more details.
Security Grades
We are constantly monitoring the security of our website. We will post our grades from public security rating agencies when they become available.
Incident Response
We have a dedicated team that responds to security incidents. We are happy to provide more details about our incident response practices upon request.
Risk Management
We have a dedicated team that manages security risks. We are happy to provide more details about our risk management practices upon request.
Asset Management
We have strict asset management policies in place to ensure that all assets are accounted for and secure.
BC/DR
We have a business continuity plan in place to ensure that we can continue to operate in the event of a disaster.
Training
We provide security awareness training to all employees to ensure that they are aware of security best practices.
Change Management
We have a change and configuration management process in place to ensure that changes are properly reviewed and approved.
Physical and Environment
We have physical and environmental controls in place to ensure that our data centers are secure and reliable.
Continuous Monitoring
We continuously monitor our systems for security threats and vulnerabilities. We are happy to provide more details about our continuous monitoring practices upon request.
Updates
2026-09 Trust Center moved in-house; the SOC 2 Type II report is available on request.
2026-06 ElevenLabs added to the subprocessor list for AI voice narration.
Questions? security@glitter.io
Access Monitoring
Glitter AI logs and monitors all access attempts to company resources through AWS CloudTrail, GCP Cloud Audit Logs, and integrated monitoring tools. Access logs are retained for one year and reviewed quarterly by the Security Officer. Automated alerting is configured for suspicious access patterns and violations.
Certificates of Destruction
Glitter AI maintains certificates of destruction for all end-of-life devices and media containing sensitive data. Physical media disposal follows NIST SP 800-88 standards with secure wiping and professional destruction services. All destruction activities are documented and certificates retained for audit purposes.
Data Asset Classification
Glitter AI maintains a four-tier data classification scheme: Public, Internal, Confidential, and Restricted. All data assets are labeled with appropriate classification metadata to enforce proper access controls and encryption requirements. Automated scans verify classification integrity and alert on misclassified items.
Data Backups
Glitter AI implements automated daily backups for all production databases and critical data. S3 backups are retained for 30 days with encryption at rest. Database backups are tested quarterly to ensure recovery capability. All backup processes are monitored with automated alerting for failures.
Data Erasure
Glitter AI implements secure data erasure using NIST SP 800-88 standards for all end-of-life devices and media. Electronic media undergoes cryptographic erasure and overwriting, while physical media is destroyed through professional shredding services. All erasure activities are documented and certificates retained for audit purposes.
Encryption-at-rest
All Glitter AI production databases and storage systems use AES-256 encryption at rest with AWS KMS-managed keys. Supabase databases are encrypted by default using AES-256. S3 buckets have server-side encryption enabled. Key rotation occurs quarterly and is documented through GitHub Issues.
Encryption-in-transit
All Glitter AI data transmissions use TLS 1.2 or higher encryption. HTTPS is enforced across all applications and APIs. Database connections and inter-service communications use encrypted connections.
Geographic Location of Data
Glitter AI customer data is stored in US regions only. AWS services are hosted in us-east-1 and other US regions, while GCP services use multi-region US storage. Data residency requirements are enforced through infrastructure configuration and no customer data is processed or stored outside the United States.
Information Disclosure Protection
Glitter AI implements multiple layers of information disclosure protection including on-device and cloud-based data redaction features, encryption at rest and in transit, access controls with role-based permissions, and comprehensive logging. Customer data is protected through privacy-by-design principles and automated redaction capabilities that prevent sensitive information exposure.
Media Data Retention
Glitter AI follows documented retention schedules for all media and data types. Customer data is retained during active subscription plus 90 days after termination. System logs are retained for 90 days in CloudWatch and 1 year in S3 archive. Database backups are retained for 30 days. All retention periods align with legal requirements and are enforced through automated lifecycle policies.
Media Protection
Glitter AI protects physical and digital media through encryption, access controls, and secure handling procedures. Company-provided laptops use full-disk encryption and are secured in home office environments. Digital media is encrypted at rest and in transit. Physical media disposal follows NIST standards with secure wiping and professional destruction services.
Physical Media Disposal
Glitter AI follows NIST SP 800-88 standards for physical media disposal. End-of-life company-provided laptops undergo secure wiping with multiple overwrite passes or cryptographic erasure. Physical destruction is performed by certified vendors for devices that cannot be securely wiped. All disposal activities are documented with certificates retained for compliance auditing.
Physical Security
Glitter AI operates as a fully remote company with physical security controls focused on home office environments and cloud infrastructure. Company-provided laptops require full-disk encryption and secure storage when unattended. Cloud infrastructure security is managed by AWS and GCP with SOC 2 compliance verified annually. Physical access to data centers is controlled by cloud providers and monitored through compliance attestations.
Secret Management
Glitter AI manages secrets and cryptographic keys using AWS KMS for encryption key management with quarterly rotation. Application secrets are stored in secure environment variables and cloud provider secret managers. Access to secrets is controlled through IAM policies with least privilege principles. Key rotation is documented in GitHub Issues and monitored through automated alerts.
Sensitive Data Management
Glitter AI implements comprehensive sensitive data management through data classification, encryption, access controls, and redaction capabilities. Customer PII is classified according to a four-tier scheme and protected with AES-256 encryption. On-device and cloud-based redaction features prevent sensitive data exposure. Access is restricted through role-based permissions and all handling is logged for audit purposes.