Security

Your data stays yours. Your IT team stays in control.

How Tacit is deployed, which models it uses, what happens to your data and how every action is recorded. SOC 2 Type II, with a CASA/ASVS assessment on record.

Request the security pack→Book a demo

Deployment

OUR CLOUD: A multi-tenant cloud, with each customer’s data isolated from every other customer’s.
YOUR AZURE: Tacit runs inside your own Azure boundary, on your subscription.
YOUR AWS: Tacit runs inside your own AWS account, on your terms.
MICROSOFT 365: Connect Teams, Outlook and SharePoint in about five minutes, with access that follows your permissions.

Models

Model makers never see your prompts

Models run on Microsoft Azure and Amazon Bedrock, where Anthropic, OpenAI and Moonshot have no access to your prompts or outputs.

IT sets the allowlist

IT chooses which models each team can use, and can block any model or provider.

Approved fallbacks only

If a provider call fails, Tacit retries on another model on your allowlist. It never falls back to a model IT hasn’t approved.

Models	Runs on	Can the model maker see it?	Does the model maker train on it?	Stored by the host?
Anthropic Claude	Amazon Bedrock	No. It runs in AWS accounts Anthropic can’t access.	No	No. Bedrock doesn’t store prompts or outputs.
Moonshot Kimi and open-weight models	Amazon Bedrock	No. Same isolation as above.	No	No
OpenAI GPT	Microsoft Azure	No. Prompts are not available to OpenAI.	No	Only for Microsoft’s abuse monitoring, which eligible customers can switch off.

Anthropic Claude
Runs on
Amazon Bedrock
Can the model maker see it?
No. It runs in AWS accounts Anthropic can’t access.
Does the model maker train on it?
No
Stored by the host?
No. Bedrock doesn’t store prompts or outputs.
Moonshot Kimi and open-weight models
Runs on
Amazon Bedrock
Can the model maker see it?
No. Same isolation as above.
Does the model maker train on it?
No
Stored by the host?
No
OpenAI GPT
Runs on
Microsoft Azure
Can the model maker see it?
No. Prompts are not available to OpenAI.
Does the model maker train on it?
No
Stored by the host?
Only for Microsoft’s abuse monitoring, which eligible customers can switch off.

Based on Microsoft’s and AWS’s published data-handling terms. In an Azure deployment, Claude and Kimi requests go to Amazon Bedrock under the same terms; IT can limit any team to Azure-hosted models.

Your data

No training without your opt-in

Model makers never train on your data. Tacit trains on it only if you opt in, in writing.

Where it lives

In our cloud with per-customer isolation, or inside your own Azure or AWS account.

Retention and deletion

Retention follows your agreement, and you can ask us to delete your data at any time.

Access and audit

Scoped per organization and person

Each customer is isolated first. Then access to tools and content is scoped to each team and each person.

Every agent action logged

Who asked, which model answered, what it read and what it did, kept for your audit and risk teams.

A named person approves

Tacit drafts and prepares. Every submission is approved by a named person on your team.

Assurance and paperwork

ASSURANCE: SOC 2 Type II, audited by Johanson Group (report dated 20 April 2026), and a CASA/ASVS assessment on record.
ON REQUEST: Our DPA, subprocessor list and security documentation.
CONTACT: hello@tacit365.com, answered the same business day.

Going through a security review?

We’ll send the security pack and join the call with your team.

Request the security pack→