Security
How we protect what you give us.
Written in the same plain English as the privacy policy. Some of this is finished. Some of it is a commitment we are building toward, and we say which is which.
Last updated 30 August 2026 / Version 1.0
01 / Encryption
In transit and at rest.
Every connection to Holocron, and every connection Holocron makes to a model provider or another service, runs over TLS. Customer content is encrypted at rest wherever it is stored. Neither of these is a plan; both are true today.
02 / Access
Fewer people can reach it than you would think.
Access to customer content is scoped to the people working on your organisation's account, not the whole company. Each engineer reaches production with their own credentials, never a shared login, and access is removed the day someone leaves.
03 / Isolation
Your organisation's content stays in its own lane.
Every customer's content is logically separated from every other customer's inside the platform. Your organisation is the controller of what goes in, we are the processor acting on your instructions, and the data processing agreement we sign with you says exactly what we may do with it. The privacy policy covers that relationship in full.
04 / Artificial intelligence
The models do not learn from you.
Holocron sends the relevant part of your content to Anthropic and OpenAI through their commercial APIs to do the work in the platform, and neither trains on it. The full picture, including exactly which provider sees what and for how long, is in sections 05 and 06 of the privacy policy, so it is not repeated here.
05 / Found something
Tell us before anyone else does.
If you find a security issue, email hello@holocron.global with what you found and how to reproduce it. We will acknowledge it, fix what needs fixing, and tell you what we did. There is no bug bounty program yet and no dedicated security@ address; this is the address that works today.
06 / If something goes wrong
You hear it from us, not a headline.
If an incident affects your organisation's content, we tell you directly, as soon as we have confirmed what happened and what it touched, rather than waiting for an investigation to fully close.
We have not published a fixed notification window yet. That number depends on a process we have not finished writing, and we would rather leave this section short than promise a figure nothing backs up.
07 / Where we are
No badges yet. Here is the honest version.
Holocron does not hold SOC 2, ISO 27001, or any other formal certification today. We are a young company building toward them, not stalling on them, and this section changes the moment any of that becomes true rather than sitting here unchanged. If your procurement process needs a specific answer before we are certified, ask; we will tell you exactly where things stand and what a review of us would actually find.
08 / Who else touches it
Every party, named.
We use a small number of outside parties to run Holocron. Each is bound by a written agreement and may only act on our instructions. This list does not yet state which country each one processes in; that is tracked as an open item, not glossed over.
| Subprocessor | What it does |
|---|---|
| Anthropic | AI model provider, processes the parts of your content sent to Claude |
| OpenAI | AI model provider, processes the parts of your content sent to GPT models |
| Supabase | Database, authentication and file storage for the platform |
| Railway | Hosts the application |
| Langfuse | Records prompts and completions for debugging and quality review |
| Cohere | Reranks retrieved content during search |
| Deepgram | Transcribes voice input, sent directly from your browser |
| Perplexity | Runs research queries on your behalf |
| Provides the Calendar and Drive connections you choose to turn on |
We tell customers before adding or replacing one, so there is time to object.
09 / What's next
Built later, not hidden now.
These are not live yet. We are listing them because a page that only shows what is finished tells you less than one that is honest about what is on the way.
10 / Changes and contact
The rest of it.
If we change this page we will change the date at the top, the same as the privacy policy. Questions, or a security report, go to hello@holocron.global.