Trust you can verify.

One deliverable, many independent checks

The challenge teams are the most visible check, not the only one. Before work starts, each task gets its own definition of done, and an independent reviewer grades the finished work against it. Work that lands below the bar is critiqued, revised, and rerun automatically, and a revision only replaces the original when it scores better. Key claims are re-verified blind: the checker answers the question without seeing the draft, and the two answers are compared. The citations that carry the recommendation are checked for whether they actually support it, not just whether the links exist. Even your own inputs are handled with care: a premise pasted into a brief is flagged for confirmation, not silently built on. And when a report reads too smooth, all confidence and no residual uncertainty, that gets challenged too.

Responsible AI output

Every deliverable is quality-scored before it reaches you. Source claims are verified and graded by reliability. Conclusions are challenged for gaps, weak evidence, and unsupported assumptions by three independent red teams, each running on a different top-tier AI model family, and their findings are cross-compared before delivery: no model approves its own reasoning. Financial assumptions are extracted and made testable. We hold AI-generated strategy work to the same standard a principal consultant would apply to their own team's output.

Tenant data isolation

Every organization's data is isolated at the database level using PostgreSQL Row-Level Security (RLS). This is not application-level filtering that a code bug could bypass. The database engine itself enforces tenant boundaries on every query, every time. Your projects, deliverables, and conversations are never visible to other customers.

Encryption

Data at rest is encrypted with AES-256. Data in transit is protected by TLS 1.3. If you bring your own LLM API keys, they are encrypted with per-tenant Fernet keys (AES-128-CBC + HMAC-SHA256) before storage and never stored in plaintext. Backups inherit the same encryption standards from our infrastructure providers.

AI governance: your data does not train AI

Calafai routes every engagement through enterprise or API contractual terms with model providers that prohibit training on tenant data. Your briefs, attachments, and outputs are not used to train Claude, GPT, Gemini, Grok, or any other model. Encrypted-at-rest storage and PostgreSQL row-level tenant isolation enforce the same boundary at the infrastructure layer.

No single AI company runs your engagement end to end. Work is routed task by task to the model best suited to it, across the providers below, and the orchestration, the quality control, and the assembled deliverable stay inside Calafai's pipeline, not inside any one provider's product.

Calafai is designed to meet the transparency obligations of EU AI Act Article 50: you always know you are working with AI, and every deliverable carries a machine-readable AI-generated marking. For procurement and legal teams, our request-ready statement is available today: read the EU AI Act Article 50 Transparency Statement (PDF) (opens in a new tab).

About the paperwork, plainly: most of our provider DPAs today are incorporated by reference, we accepted each provider's standard API Terms, which include the published DPA, rather than separately negotiated, counter-signed enterprise PDFs. That is normal for a seed-stage SaaS and is the standard contractual posture across the industry at our scale; we flag it here because procurement reviewers ask. xAI's counter-signed DPA is being closed. Google traffic runs on the Gemini API paid tier, where Google's terms state that prompts and responses are not used to improve Google's products and processing falls under Google's Data Processing Addendum; a move to Vertex AI / Google Cloud remains on our roadmap for enterprise and EU-residency configurations. Mistral AI runs on its paid tier with EU-hosted endpoints and anchors EU-residency configurations for Enterprise engagements. Tenant data is not used for training on any provider regardless of paperwork form.

Need a specific provider excluded for internal policy reasons? That becomes a custom engagement, contact us to set up a call.

Data privacy & GDPR

Calafai B.V. is incorporated in the Netherlands and built with European data protection regulation from day one. Full data portability via one-click export. Right to deletion with cascade removal across all projects, deliverables, and run history, with audit trail anonymization. Cookie consent management is built in. Data processing agreements are available on request for enterprise customers.

Security

Calafai is built to SOC 2 and ISO 27001 control frameworks: the same access control, change management, and audit-logging discipline those frameworks require. Formal certification is staged as enterprise procurement requires it, and any certificate earns a place on this page the day it is issued. Our infrastructure providers, Supabase (database and authentication), Vercel (web application), and Railway (compute), are themselves SOC 2 Type II certified, with encrypted-at-rest storage across the board. Security headers are enforced platform-wide: Content Security Policy, HTTP Strict Transport Security, X-Frame-Options, Cross-Origin Resource Policy, and Permissions-Policy. Webhook deliveries to your systems are signed with HMAC-SHA256 for authenticity verification. The baseline is European security standards, among the world's most demanding, and the standard we hold ourselves to.

Data residency

Production hosting is in the United States today. For Enterprise engagements that require EU data residency, we scope and stand up an EU-resident configuration as part of your contract. The way Calafai is built, that is a scoped setup rather than a re-architecture, so it moves quickly once we agree on what you need. There are real trade-offs worth discussing, and we will walk you through them. Contact us to start that conversation.

Accessibility

Accessibility is built into Calafai from the first commit, not retrofitted at the end. Semantic structure, full keyboard operability, visible focus states, and contrast that never depends on color alone are part of how the product is designed. It is how the founder practiced design, product development, and team leadership his entire career, and is one of Calafai's principles, so the people who rely on assistive technology get the same product as everyone else.

Incident response

Security issues can be reported to [email protected]. We acknowledge reports within 24 hours and provide resolution timelines within 72 hours. Platform status and scheduled maintenance are communicated proactively. We do not currently operate a public bug bounty program, but responsible disclosure is welcomed and credited.