Home

Trust & security

Effective October 2, 2026

CAIObarn is built for teams that run AI governance for a living, so the security of the platform itself is held to the same standard. This page summarizes how we protect your data and points to the agreements behind it. For security questionnaires, pen-test results, or our current hosting location, contact crewchief@vibecohort.com.

Workspace isolation

Every record in CAIObarn — engagements, initiatives, roadmaps, decisions, AI systems, controls, evidence, and files — belongs to exactly one workspace. Access is enforced at the database layer with row-level security: a member of one workspace cannot read or write another workspace's data, even through the API. Roles inside a workspace (owner, admin, member) control who can view and change what, and privileged server operations require an explicit membership check.

Access & authentication

  • Email confirmation is required before a new account can sign in.
  • Multi-factor authentication (TOTP authenticator apps) is supported and enforced per workspace policy for sensitive views.
  • SAML single sign-on is available for enterprise customers.
  • Workspace invitations expire after 14 days and can only be accepted by the invited address.
  • Third-party integration credentials (Jira, Linear, Azure DevOps, cost feeds, notification channels) are stored encrypted and are readable only by the server after a membership check — never by other members.

Audit trail & evidence

CAIObarn keeps an append-only history of the things auditors ask about: every roadmap date change with a required reason, every change to an AI system's model or risk tier, every control attestation, and every decision approval with its note and approver. Workspaces can export this history, together with the full AI register and controls status, as CSV or PDF from the in-app Audit pack.

How we use AI

AI features (extraction, analysis, reports, framework drafting) run only when you trigger them, on the engagement data you choose to include. Your engagement content is not used to train CAIObarn's own models — we don't train models. Model providers process prompts under their own commercial terms; an enterprise bring-your-own-key option routes AI calls through your own provider accounts instead. Notes and meetings marked "eyes only" are excluded from automated report context.

Data residency & hosting

CAIObarn runs on managed cloud infrastructure with encryption in transit (TLS) and at rest. Customer data is hosted in the United States (North America). An EU hosting option is planned. Further infrastructure details are available on request for procurement and security review — crewchief@vibecohort.com.

Subprocessors

  • Managed cloud database, hosting, and authentication provider — application data, accounts, sessions.
  • AI model providers (e.g. OpenAI, Anthropic) — only the data included in a feature you trigger.
  • Paddle — subscription billing and payments; card details never touch CAIObarn.
  • Transactional email delivery — account confirmation, invitations, and alerts you configure.

A current subprocessor list with locations is available on request and is updated before any new subprocessor processes customer data.

Data retention & deletion

Workspace data is retained while the workspace is active. AI analyst sessions are purged after 90 days. Deleting a workspace removes its engagement data; some records may persist in encrypted backups for a limited window for disaster recovery. Full details are in our privacy policy and data processing agreement.

Agreements