--- title: "Security at Pelles AI | Trust & Compliance" description: "Pelles is built for the security teams reviewing it: encryption, access control, tenant isolation, audit logging, and SOC 2 Type II attestation." canonical: https://www.pelles.ai/security last_updated: 2026-10-25 --- [](https://trust-center.pelles.ai)Security & trust # Trust & security as a baseline, not an afterthought. Construction operations run on sensitive documents — bid pricing, contracts, drawings, project records. We’ve built Pelles to handle them with the rigor a procurement team would expect, and this page tells you the truth about where every framework and control stands today. - SOC 2 Type II attested - Annual Pen tests - No model training on customer data 01 · Frameworks ## Compliance status One row per framework. Status badges read green for attested, amber for in progress, and cyan for aligned (controls in place, no formal certification). - F-01 SOC 2 Type II Unqualified opinion for the period 1 June – 31 August 2026, covering the Security trust services category. Examined by Decrypt Compliance. The report is restricted-use — request it in the Trust Center and we release it under NDA. [Request the report](https://trust-center.pelles.ai) Attested - F-02 GDPR Customer data handling and subject-access procedures align with EU and UK requirements. Aligned - F-03 CCPA / CPRA Customer data handling and subject-access procedures align with California privacy requirements. Aligned ### Pelles AI Trust Center The documents behind this page, in one place: the SOC 2 Type II report and pen-test summary (released on request under NDA), the control-by-control detail across access, data, endpoint, product, continuity and organizational security, and the current subprocessor register. [Open the Trust Center](https://trust-center.pelles.ai) 02 · Controls ## What’s in place today The technical and operational controls Pelles runs on right now. Every item below is true today — nothing aspirational on this page. Encryption AES-256 at rest. TLS 1.2+ in transit. Keys managed by industry-standard cloud KMS. Access control SSO and SAML available to enterprise customers on request. Role-based access control. Multi-factor authentication. Least-privilege internal access. Tenant isolation Multi-tenant by default with strict logical isolation. Single-tenant and customer-managed cloud deployments offered to enterprise customers on request. Audit logging Key user actions are logged with user, timestamp, and resource. Logs are exportable for customer audit needs. Data handling Project documents, conversations, and outputs stay isolated to your tenant. No cross-tenant data flow, no shared embeddings. Model training We do not train models on customer data — neither the documents you upload nor how you use the platform (queries, conversations, telemetry). Infrastructure Hosted on industry-leading cloud infrastructure (SOC 2 Type II and ISO 27001 attested). Automated backups. Penetration testing Annual third-party penetration test completed in 2026 (all resolved). Executive summary available through the Trust Center under NDA. 03 · Principles ## How we think about security The four ideas the technical controls above are built on. They shape every decision — not just the ones a checklist asks about. - P-01 ### Least privilege by default Internal access to customer data is scoped to the minimum required and granted only when needed. Default-deny, not default-allow. - P-02 ### Defense in depth No single control protects customer data. Encryption, tenant isolation, access controls, and audit logging operate independently — a failure in one shouldn’t compromise the rest. - P-03 ### Customer data stays the customer’s Your project data is yours. We do not train models on it and do not use it to improve our product without explicit consent. - P-04 ### Auditable by design Privileged actions are logged. Configuration changes are versioned. The platform is designed so that, when an auditor asks what happened, you can show them. ## Frequently Asked Questions Is Pelles SOC 2 compliant? Yes. Pelles completed a SOC 2 Type II examination for the period 1 June to 31 August 2026, conducted by Decrypt Compliance, and received an unqualified opinion. The examination covers the Security trust services category as defined by the AICPA. The report is restricted-use: request it through the Pelles AI Trust Center at trust-center.pelles.ai and we release it under NDA, or contact security@pelles.ai or your account representative. Does Pelles train AI models on customer data? No. Customer project documents and data are used only to produce outputs for that customer. Pelles does not use customer content to train foundation models, fine-tune models for other customers, or improve product features for other tenants. This is a contractual commitment in the enterprise agreement, not a soft policy. How is customer data isolated between Pelles tenants? Pelles uses tenant-isolated data stores with logical separation by customer organization. Project documents, embeddings, and outputs from one customer are never accessible to another customer's queries or AI runs. Encryption keys, access logs, and audit trails are scoped per tenant. How does Pelles encrypt customer data? Pelles encrypts customer data in transit (TLS 1.2+) and at rest (AES-256). Access to customer data by Pelles personnel is restricted by role and logged. Encryption keys are managed by the cloud provider key management service with regular rotation. Has Pelles been penetration tested? Yes. Pelles undergoes third-party penetration testing on its production application and infrastructure. The most recent report is listed in the Pelles AI Trust Center at trust-center.pelles.ai and released under NDA on request — or contact security@pelles.ai or your account representative. What access controls does Pelles support? Pelles supports role-based access control (RBAC) within each tenant, single sign-on (SSO) integration with common enterprise identity providers, audit logging of user and admin actions, and granular permissions over which projects and documents specific users can access. [View all FAQs →](https://www.pelles.ai/faq) ## Have a security question or vendor review? Most vendor reviews are answered by the [Trust Center](https://trust-center.pelles.ai) — reports, controls and subprocessors, without waiting on us. For anything it doesn’t cover, reach out and we’ll get back to you within one business day. See what runs on top — [Pelles Core](https://www.pelles.ai/pelles-core) or browse our [integrations](https://www.pelles.ai/integrations). [Contact us](https://www.pelles.ai/contact) Last updated October 2026