# Security

Last updated: [ date ]

## In brief

- SOC 2 Type II readiness is in progress, and we are GDPR and CCPA aligned.
- A test usually needs only a URL, a design link or a creative asset, never your customer PII.
- Your data is not used to train models or shared with other clients, and it is deleted on request.
- For vendor review, we share our sub-processors, DPA and architecture under NDA.

## 01 Compliance

Where Talp stands on SOC 2, GDPR and CCPA, and how to get status updates.

- SOC 2 Type II readiness in progress, monitored continuously
- GDPR and CCPA aligned, with data subject requests honored
- Policies, access reviews and vendor tracking maintained centrally
- Status updates available on request during evaluation

Your rights over personal data are set out in our [Privacy Policy](https://talp.ai/privacy#your-rights).

## 02 Your data

What we ask for, what we never ask for, and how long we keep it.

- We only need what the test needs, usually a URL, a design link or a creative asset
- We do not require, ask for, or want your customer PII
- We do not train models on your data, and we do not share it with other clients
- Deletion on request, and retention limited to the life of the engagement

## 03 How personas work

Synthetic personas, grounded in real outcomes, with no profiles of real customers.

- Personas are synthetic, we do not build one to one twins of real individuals
- Grounding comes from historical real behavioral outcomes, not survey responses
- No personal profiles of your customers are created, stored or resold
- Outputs describe behavior patterns, never identifiable people

## 04 If you calibrate with your own data

Optional, aggregate, and kept to your engagement.

- Optional, and never required to run a simulation
- Aggregate behavioral patterns and segment definitions only, no customer level records
- Never used to train shared models and never reused for another client
- Scoped, retained for the engagement, and deleted on request

## 05 Controls

The safeguards in place: encryption, access control, hardened headers and incident response.

- Encryption in transit and at rest
- Least privilege access, reviewed on a schedule
- Hardened application headers, including a strict content security policy
- Incident response with prompt notification to affected clients

## 06 The detail, under NDA

The documents your security team can sign against.

Full sub-processor list, DPA, architecture detail and completed security questionnaires are available on request under NDA. We keep the public version of this page deliberately short, because the detail belongs in a document your team can sign against rather than on a marketing site. Email [info@talp.ai](mailto:info@talp.ai) and we will get it to you.

Send us your questionnaire. [info@talp.ai](mailto:info@talp.ai)

Talp Inc., 1401 Pennsylvania Avenue, STE 105, Wilmington, DE 19806, United States

Also read: [Privacy Policy](https://talp.ai/privacy), [Terms of Service](https://talp.ai/terms)