Security and privacy

A short summary for IT, security and procurement reviews. The full details are on the linked pages.

Data handling

• The managed service, application data and standard language models are hosted in the European Union.
• Customer prompts, files, templates and presentations are not used to train AI models by default.
• Data is encrypted in transit with TLS 1.3 and at rest with AES-256.
• Each organization runs in its own isolated workspace.
• The information security management system is ISO/IEC 27001 certified.
• offgen is developed and operated by Aithera GmbH in Munich, Germany.

Sign-in and single sign-on (SSO)

People sign in with Microsoft (Microsoft Entra ID), using their work or personal account, or with an offgen.ai email and password. A Microsoft account can add a password under Account security. Roles control what each person can do; see Users, teams and roles.

• Single sign-on: Microsoft sign-in is the single sign-on that offgen offers today. There is no SAML connection to other identity providers and no SCIM provisioning.
• Automatic join: offgen support can link your Microsoft tenant or email domain to your organization, so everyone who signs in from it joins as a Member. Ask support@offgen.ai.
• Removing people: Admins remove people under Users; access ends immediately.

The Enterprise plan lists SSO. If your requirements go beyond Microsoft sign-in, contact us.

Documents for your review

• Security: architecture and certifications
• EU hosting: where data is hosted and processed
• Data processing agreement
• Privacy policy
• Trust center: current controls and evidence

For security questionnaires, contact security@offgen.ai.

Related

• Connect SharePoint: read-only access to selected sites
• API keys: create and revoke keys
• FAQ: short answers for evaluators