Security

Point11 is committed to protecting the security and privacy of our customers’ data. This page describes our security practices and infrastructure.

Infrastructure

The Point11 platform is hosted on Vercel, with managed Postgres (Neon) and Redis (Upstash), all in the United States. Customer deployments may run in customer-controlled cloud environments under enterprise agreements.

• Data encrypted in transit using TLS 1.2 or higher for all connections
• Data encrypted at rest using AES-256 or equivalent
• Multi-factor authentication required for all administrative access
• Role-based access controls with least-privilege principles
• Access to production systems restricted to authorized engineering personnel and reviewed regularly
• Web application firewall and DDoS mitigation
• Separation between production and development environments

Data Handling

We do not use customer data to train, fine-tune, or improve AI models, and the third-party AI providers we route requests through are contractually restricted from training on it.

Customer data is stored and processed within the United States unless otherwise agreed in writing. Upon termination of an agreement, customer data is available for retrieval for 30 days, after which it is securely deleted.

Point11 does not directly process or store payment card data; payment processing is handled by PCI DSS-certified processors (Stripe). To discuss HIPAA requirements or other compliance needs, contact legal@point11.ai.

Practices

• Automated vulnerability scanning and timely patching by severity
• Security incidents affecting customer data are reported to affected customers without undue delay, as required by applicable law
• Post-incident review and remediation for confirmed incidents
• Security awareness training and confidentiality agreements for all personnel
• Automated backups and multi-region architecture for production systems

Responsible Disclosure

If you discover a security vulnerability in Point11’s platform, please report it to support@point11.ai. Scope, safe harbor, and reporting guidance: vulnerability disclosure policy.

Due Diligence

Enterprise customers may request additional security documentation as part of procurement. Contact legal@point11.ai or your account representative.