Tenant-aware access
Workspace-scoped data access and reviewer workflows are treated as core product constraints.
Security and privacy
Security copy should be as reviewable as the product.
CVault separates controls available now, deployment-specific commitments, and claims that are not made without evidence.
What is protected now, what depends on customer setup, and what is not claimed?
workspace scope
audit events
retention terms
deployment review
DPA review
security notes
Control areas
The public security page is deliberately precise: no fake badges, no broad compliance guarantees.
Retention and erasure
Pilot data is handled with explicit lifecycle expectations before broader rollout.
Claim-safe procurement
Security and privacy copy separates available controls from contract-scoped commitments.
Claim registry
Reviewed public claims
Each statement carries an internal evidence ID and a status so buyers can see what is available versus scoped.
Privacy review support for approved deploymentspolicy commitment
Evidence ID: privacy-dpa-retention-controls. Category: privacy.
DPA supportcustomer scoped
Evidence ID: dpa-page-and-vendor-review. Category: privacy.
No model training by defaultpolicy commitment
Evidence ID: model-use-policy. Category: privacy.
Retention controlsavailable now
Evidence ID: data-retention-policy. Category: privacy.
SSO / SCIM supportcustomer scoped
Evidence ID: enterprise-roadmap-and-contract-review. Category: security.
RBAC and audit exportsavailable now
Evidence ID: workspace-security-controls. Category: security.
SLA by agreementcustomer scoped
Evidence ID: enterprise-contract-review. Category: operations.
17 languagesavailable now
Evidence ID: parser-language-routing. Category: parser.
Zapier workflow supportplanned not claimed
Evidence ID: integration-copy-review. Category: integration.
Reviewed rollout
Review controls before sharing candidate data.
Use a scoped pilot to confirm data handling, retention, and reviewer access expectations.