Trust Center
We handle some of the most sensitive data there is: conversations that may involve a child. This page sets out how we protect it, what we commit to, and where our independent audits currently stand.
Independent audits
SOC 2 Type II
An independent examination of how we actually operate our security controls over a sustained observation window, covering security, availability, and confidentiality. This engagement is underway. We have not yet received a report, and we do not claim certification until we have.
ISO/IEC 42001
The international management-system standard for responsible AI, covering governance of how a model is built, evaluated, monitored, and corrected. Relevant to us because Aletheia makes consequential judgments about people. This engagement is underway and not yet certified.
If you are evaluating Polycreek for a partnership or procurement review and need the current status, scope, or auditor details, contact us and we will share where things stand.
How we handle conversation data
Zero retention by default
A conversation sent to our API is scored and then discarded. We do not keep the text. Where a customer enables audit logging, we store a SHA-256 hash of the conversation plus metadata such as score, threshold, and model version, never the content itself.
No standing human access to content
Because content is not retained, there is no mechanism for staff to browse customer conversations. Serving logs contain hashes and scores. In self-hosted deployments, content never leaves the customer environment at all.
Customer data is never training data
Models are trained on our own corpus. Customer traffic is not used for training or fine-tuning. Detection-improvement telemetry, if a customer opts into it, is limited to hashed, non-reversible signals and is off by default.
We assume a minor is involved
Every input is treated as potentially containing a child's data. We do not build profiles of children and we do not link scores to identities. The platform sending content remains the data controller; Aletheia acts as a processor that returns a score.
Platform security
Encrypted in transit
All API and web traffic is served over TLS. Certificates are managed and renewed automatically.
Scoped API credentials
Every customer holds its own key, with per-customer rate limiting and usage accounting. Keys can be rotated or revoked on request.
Monitored availability
Service health is continuously checked and published, with incident and maintenance history on our public status page.
Least-privilege administration
Administrative interfaces are authenticated separately and restricted to the smallest set of people who need them.
Self-hosting available
Customers with strict data-residency or isolation requirements can run Aletheia entirely inside their own environment.
Published uptime
Current and historical service status is public at status.polycreek.org.
Regulatory posture
We design against COPPA, GDPR, KOSA, and the EU Digital Services Act. Our zero-retention default is the main reason this is tractable: most obligations that attach to storing children's data do not arise if the data is never stored.
Where a customer carries a reporting obligation, Aletheia is built to support fast escalation of high-confidence threats, including a triage path aimed at reporting to NCMEC within 24 hours. The reporting entity remains the platform; we do not file on a customer's behalf by default.
Policy library
Every policy that governs how Polycreek operates. Governance policies are adopted by our Board of Directors. Operational policies cover security, data handling, child safety and AI governance. We list every policy we maintain so you can see what exists, and the complete documents go to partners, platform customers, grantmakers, auditors and donors on request, with security documentation shared under a mutual non-disclosure agreement.
Governance
Conflict of Interest Policy
How directors, officers and staff disclose competing interests, and how the Board handles a transaction where one exists.
Available on request →Whistleblower Protection Policy
How to raise a concern about misconduct, including anonymously, and the protection against retaliation for doing so.
Available on request →Internal Financial Controls Policy
Segregation of duties, authorization limits, and the controls governing how charitable funds are received and spent.
Available on request →Document Retention, Destruction and Legal Hold Policy
How long organizational records are kept, how they are destroyed, and what happens when a legal hold applies.
Available on request →Donation and Gift Acceptance Policy
What gifts Polycreek accepts, what it declines, and the review required for restricted or non-cash contributions.
Available on request →Security
Information Security Policy
The overarching security program: what we protect, who is accountable, and the controls that apply across the organization.
Available on request →Access Control Policy
How identities are issued, how least privilege is enforced, and how access is reviewed and revoked.
Available on request →Incident Response Plan
How we detect, triage, contain and disclose a security or privacy incident, including notification timelines.
Available on request →Secure Software Development Policy
Security requirements across design, code review, dependency management, testing and deployment.
Available on request →Vendor Risk Management Policy
How third parties and subprocessors are assessed before onboarding and monitored afterward.
Available on request →Data and privacy
Data Retention Policy
What data we hold, for how long, and the zero-retention default that applies to conversation content.
Available on request →Privacy Impact Assessment Policy
When a privacy assessment is required, what it must cover, and who signs it off before a change ships.
Available on request →Child Safety Policy
Our commitments on handling material involving minors, escalation duties, and reporting to NCMEC.
Available on request →AI governance
AI Governance Policy
Accountability for how Aletheia is built, approved, deployed, monitored and withdrawn, including human oversight.
Available on request →Model Evaluation and Bias Documentation Policy
Required evaluation before a model release, the fairness testing we perform, and what we document and publish.
Available on request →Need something that is not here?
We will provide the full text of any policy above, plus a signed copy where you need one, our certificate of incorporation, our IRS determination letter, our annual returns, or a completed security questionnaire. Tell us what the document is for and we will turn it around quickly.
Documents and disclosures
Privacy Policy
How we collect, use, and protect personal data.
Governance
Board oversight and public filings.
Data Request
Request access to or deletion of your personal data.
API Documentation
Integration details, authentication, and response format.
FAQ
Direct answers on training data, retention, and reporting.
Report a security issue
Found a vulnerability? Tell us and we will respond.