Data Privacy
Privacy of customer data is top of mind. We follow industry best practices and follow all applicable privacy regulations.
Overview
Welcome to Glitter AI's Trust Center. Our commitment to data privacy and security is embedded in every part of our business.
About Glitter AI
Glitter AI makes business process documentation fast and easy. We help organizations turn every process into a step-by-step guide, streamlining operations and improving efficiency.
Our Security Commitment
At Glitter AI, security and privacy are foundational to everything we do. We implement industry-leading security controls and maintain compliance with rigorous standards to protect our customers' data and ensure business continuity.
What You'll Find Here
- Learn about our comprehensive security posture
- Access our security documentation and certifications
- Review our compliance frameworks and attestations
- Understand our data protection and privacy practices
For security inquiries or to request additional documentation, please contact our security team at security@glitter.io.
Compliance
SOC 2 Type II Auditor: GRSee Consulting 
HIPAA BAA available Reports and documents
The SOC 2 report is sent on request SOC 2 Type II report · on request
Subprocessor list · public Data Processing Agreement · public HIPAA and BAA · public Risk profile
Data access level Internal
Impact level Moderate
Recovery time objective 4 hours
Recovery point objective 24 hours
Critical dependence Yes
Third party dependence Yes
Hosting Major cloud provider
See the questions Product security
Data security
Application security
AI
Governance and ethics
Legal
Infrastructure
Frequently asked
Do you train any AI models on customer data? View all 1Security practices
Access Control
Access is tightly monitored and controlled at our company. We are happy to provide more details about our access control practices upon request.
Endpoint Security
We follow industry best practices for endpoint security. We are happy to provide more details about our endpoint security practices upon request.
Network Security
We protect our corporate network against external and internal threats.
Corporate Security
We implement internal measures and practices to maintain a high standard of security.
Policies
Our information security policies are reviewed and approved annually. Please contact us for more details.
Security Grades
We are constantly monitoring the security of our website. We will post our grades from public security rating agencies when they become available.
Incident Response
We have a dedicated team that responds to security incidents. We are happy to provide more details about our incident response practices upon request.
Risk Management
We have a dedicated team that manages security risks. We are happy to provide more details about our risk management practices upon request.
Asset Management
We have strict asset management policies in place to ensure that all assets are accounted for and secure.
BC/DR
We have a business continuity plan in place to ensure that we can continue to operate in the event of a disaster.
Training
We provide security awareness training to all employees to ensure that they are aware of security best practices.
Change Management
We have a change and configuration management process in place to ensure that changes are properly reviewed and approved.
Physical and Environment
We have physical and environmental controls in place to ensure that our data centers are secure and reliable.
Continuous Monitoring
We continuously monitor our systems for security threats and vulnerabilities. We are happy to provide more details about our continuous monitoring practices upon request.
Updates
2026-09 Trust Center moved in-house; the SOC 2 Type II report is available on request.
2026-06 ElevenLabs added to the subprocessor list for AI voice narration.
Questions? security@glitter.io
Audit Logging
Glitter AI maintains comprehensive audit logging across all systems to enable security monitoring and compliance. AWS CloudTrail captures all management and data events, while GCP Cloud Audit Logs track admin activity and data access for AI services. All logs are encrypted with AES-256, stored in immutable S3 buckets, and retained for 180+ days. GuardDuty and Security Command Center provide continuous threat detection with automated alerting.
Data Security
Glitter AI implements comprehensive data security measures to protect customer information throughout its entire lifecycle.
Data Protection
- End-to-end encryption for data in transit and at rest
- AES-256 encryption standards for stored data
- TLS 1.2+ for all data transmissions
- Regular encryption key rotation and management
Access Controls
- Principle of least privilege for all data access
- Role-based permissions and access restrictions
- Multi-factor authentication requirements
- Regular access reviews and deprovisioning
Data Classification
- Systematic classification of all data types
- Appropriate handling procedures for each classification level
- Clear data retention and disposal policies
- Regular data inventory and mapping exercises
Integrations
Glitter AI integrates with carefully vetted third-party services to enhance functionality while maintaining security. Key integrations include AWS, GCP, Vercel, Stripe for payments, OpenAI and ElevenLabs for AI services, Mixpanel for analytics, Intercom for support, and Sentry for monitoring. All integrations use encrypted connections (TLS 1.2+), API tokens with scoped permissions, and undergo security assessments.
Multi-Factor Authentication
Multi-factor authentication is mandatory for all administrative and production system access at Glitter AI. MFA is enforced across AWS, GCP, GitHub, Google Workspace, Slack, Sentry, Mixpanel, Intercom, Segment, Vercel, Stripe, and Supabase. User authentication in the product leverages Supabase Auth with MFA support, providing secure access to all customer-facing features.
Product Architecture
Glitter AI uses a secure, scalable cloud architecture built on AWS, GCP, and Vercel. The system features multiple security boundaries including application layer authentication via Supabase, encrypted data storage with AES-256, TLS 1.2+ for all communications, and Row Level Security policies. Infrastructure includes CDN distribution, serverless functions, and automated backups with 4-hour RTO and 24-hour RPO for disaster recovery.
Role-Based Access Control
Glitter AI implements comprehensive role-based access control following the principle of least privilege. Access to production databases is restricted to the CTO only, AWS/GCP console access is limited to the Security Officer, and all administrative access requires documented business justification. Quarterly access reviews ensure permissions remain appropriate, and Supabase Row Level Security enforces user data isolation at the database level.
Service-Level Agreement
Glitter AI maintains service level commitments with 4-hour Recovery Time Objective (RTO) and 24-hour Recovery Point Objective (RPO) for disaster recovery scenarios. The platform leverages cloud provider SLAs including AWS, GCP, and Vercel for infrastructure reliability. Monitoring and alerting systems provide real-time visibility into system performance and availability through Sentry, CloudWatch, and automated health checks.
SSO Support
Glitter AI integrates with Google Workspace SSO for centralized identity management across internal systems. Enterprise customers can leverage Supabase Auth’s SAML and OAuth integrations for single sign-on access to the product. All SSO connections use industry-standard protocols and are configured with appropriate session timeouts and security policies.
Team Management
Glitter AI provides comprehensive team management capabilities through Supabase Auth and role-based access controls. Administrators can manage user permissions, assign team roles, and control access to organizational resources. The product includes user provisioning and deprovisioning workflows, team collaboration features, and audit trails for all user management activities.