Security

• SOC 2 Type II readiness in progress, monitored continuously
• GDPR and CCPA aligned, with data subject requests honored
• Policies, access reviews and vendor tracking maintained centrally
• Status updates available on request during evaluation

Your rights over personal data are set out in our Privacy Policy.

• We only need what the test needs, usually a URL, a design link or a creative asset
• We do not require, ask for, or want your customer PII
• We do not train models on your data, and we do not share it with other clients
• Deletion on request, and retention limited to the life of the engagement

• Personas are synthetic, we do not build one to one twins of real individuals
• Grounding comes from historical real behavioral outcomes, not survey responses
• No personal profiles of your customers are created, stored or resold
• Outputs describe behavior patterns, never identifiable people

• Optional, and never required to run a simulation
• Aggregate behavioral patterns and segment definitions only, no customer level records
• Never used to train shared models and never reused for another client
• Scoped, retained for the engagement, and deleted on request

• Encryption in transit and at rest
• Least privilege access, reviewed on a schedule
• Hardened application headers, including a strict content security policy
• Incident response with prompt notification to affected clients

Full sub-processor list, DPA, architecture detail and completed security questionnaires are available on request under NDA. We keep the public version of this page deliberately short, because the detail belongs in a document your team can sign against rather than on a marketing site. Email info@talp.ai and we will get it to you.