Security at Flexivity AI

Flexivity AI is built around a simple idea: the best way to protect sensitive data is to avoid keeping it. Our AI reads your tickets as your customers wrote them, so it can answer with the details that matter, and everything we store is scrubbed of personally identifiable information first. Everything else — encryption, access controls, monitoring, and compliance — is built on top of that foundation.

This page is a plain-language summary. If you are evaluating Flexivity AI and need architectural detail, we share a comprehensive Security & Trust Overview under NDA — see Request the full overview below.

Our approach

Raw in flight, scrubbed at rest. Ticket and chat text is read as written while it is being worked on, and personally identifiable information is scrubbed from anything before it is stored. We use Microsoft Presidio  to detect names, email addresses, phone numbers, physical addresses, account numbers, and other common PII categories, and only scrubbed, placeholder-substituted text is written to our databases, search indexes, and logs. Three kinds of data are masked before anything else touches the text, even in flight: payment card numbers, government identifiers (US Social Security and taxpayer numbers), and bank account numbers. That masking is best effort: it is tuned to catch these numbers without mistaking order numbers or product codes for them, and no detector catches everything.

Defense in depth. No single control protects your data on its own. Authentication, encryption, network isolation, PII scrubbing, and automated tenant isolation each provide independent layers. Critical controls are enforced by automation, not convention.

Minimum credential footprint. We don’t store customer helpdesk passwords or long-lived helpdesk API keys. The secrets we do hold — signing keys, OAuth tokens, and similar — are stored in AWS Secrets Manager, customer-revocable, and used only where they are strictly required.

What this means in practice

What we store is scrubbed. Raw ticket content is never written to Flexivity AI storage. Ticket and chat text is fetched from your help desk over TLS when it is needed, with the three kinds of data above masked as it arrives, and is scrubbed before it is stored or indexed. Our queues carry ticket and message identifiers rather than their text, and our logs carry no ticket text. The one exception is a reply on its way to your help desk, such as an osTicket note waiting for its plugin: it is held as written, encrypted, and deleted within 24 hours. With our on-premise agent for osTicket, the agent masks the same three kinds of data inside your network, and ticket text crosses to our cloud, over TLS, when the AI needs it.

Everything runs on AWS. Flexivity AI is hosted entirely on Amazon Web Services. All data storage, all processing, and all AI model inference happen inside our AWS environment. Customer data does not traverse third-party services outside AWS.

AI models read your tickets, and keep nothing. We use large language models hosted on Amazon Bedrock within our AWS account. Models read ticket text as written, apart from the masked data above, so an answer can use the customer’s own order number, product, or date. Per Bedrock’s terms, prompts and completions are not used to train or improve foundation models and are not shared with model providers. Our Bedrock account is set to retain no prompts or completions, and model invocation logging is off.

You control your data. Per-ticket deletion is supported for right-to-erasure requests, and every deletion is recorded in a write-once ledger that is replayed if we ever restore from a backup, so a deleted ticket does not come back. Customer administrators can rotate credentials themselves. Upon termination, customer data is deleted within 30 days. Data residency is in the United States, with additional regions available on request.

Availability is tracked publicly. We publish real-time service status and incident history at status.flexivity.ai . You can subscribe to updates via RSS .

Multi-tenant isolation is enforced, not just documented. Every database query against multi-tenant data is automatically validated to confirm appropriate tenant scoping. Queries missing the required isolation filter fail integration tests and trigger alerts in production — so tenant isolation is a system property, not a coding discipline.

Compliance

We maintain a SOC 2 readiness posture across the Trust Services Criteria for Security, Availability, and Confidentiality. SOC 2 Type 1 attestation is in preparation. The controls that will be attested — encryption, access management, vulnerability scanning, network isolation, automated backups, logging, and incident response — are already in place and operating.

Flexivity AI implements privacy-supporting controls including PII scrubbing of everything stored, masking of payment, government, and bank identifiers in flight, targeted data deletion that survives backup restores, and regional data residency.

Request the full overview

For prospects, customers, and security teams that need architectural and control detail beyond what is summarized here, we maintain a comprehensive Security & Trust Overview. It covers the full authentication surface across our integrations, infrastructure architecture, PII masking and scrubbing, audit logging, incident response, subprocessor list, and SOC 2 control mapping.

Contact

For security questions or to request the full overview: security@flexivity.ai