AnyDB is built to keep your operational data protected, controlled, and available to the people and systems you authorize. Review our security practices, privacy commitments, infrastructure, and compliance program.
AnyDB combines technical controls, documented operating practices, contractual safeguards, and customer-controlled permissions. Our compliance program continues to mature as we expand support for regulated and enterprise deployments.
AnyDB supports GDPR requirements through its Data Processing Agreement, customer data controls, data-subject rights, retention practices, subprocessor management, and contractual safeguards for international processing.
Read our Privacy PolicyHIPAA compliant deployments are available. AnyDB supports HIPAA-regulated workloads under an executed Business Associate Agreement and an approved deployment configuration. Contact us before storing protected health information.
Discuss a HIPAA deploymentAnyDB is developing its SOC 2 assurance program and implementing an information security management system aligned with ISO/IEC 27001:2022, with independent assurance and certification as the intended outcomes.
Ask about our assurance programAnyDB applies security controls across its infrastructure, application, development process, and customer access model. Data access is authenticated, scoped to the appropriate team, and evaluated against configured permissions.
AnyDB enforces TLS 1.2 or higher for data in transit. Customer data is encrypted at rest using encryption provided by the underlying AWS services. Production-resource access is restricted through AWS identity and access-management controls.
The standard SaaS environment uses shared cloud infrastructure with logical tenant isolation. Requests are authenticated and scoped to the relevant team before data access is permitted.
Access can be controlled at the team, workspace, record, document, file, and field or cell level. Group controls help expose only the information each person needs.
Explore enterprise controlsAnyDB supports Microsoft Entra ID and Okta through OpenID Connect. Approved custom-domain configurations can enforce SSO-only access, with multi-factor authentication enforced through the organization’s identity provider.
MCP connections use OAuth 2.1 and operate with the authenticated AnyDB user’s permissions. Administrators can control available MCP tools, and authorized administrators can revoke or rotate API credentials.
Important changes and actions are recorded in audit and version history. Customer audit logs are retained for 90 days and can be retrieved through the AnyDB API. Invited support-user actions are attributed in customer audit history.
Read the audit log guideProduction changes use version control, peer review, automated testing, controlled deployment, and post-deployment monitoring. Security testing includes dependency and secrets detection, application scanning, container scanning, and software-bill-of-material generation.
Customers control the business information stored in AnyDB. We process customer content to provide, secure, support, and improve the service, or as otherwise directed and agreed with the customer.
AnyDB does not sell or rent customer content. Customers can export records and files using supported standard formats and can request assistance for larger exports.
For customer content, the customer generally acts as data controller and AnyDB acts as data processor. The Data Processing Agreement describes the parties’ obligations, subprocessors, and applicable international-transfer safeguards.
Customers may export data during an active subscription and the applicable post-termination return period. Deleted content is removed from active systems. Residual encrypted copies may remain until they expire through the normal backup cycle, no later than 90 days after deletion.
For workspace implementation or troubleshooting, a customer can explicitly invite an AnyDB support user. Actions are attributed in the audit log, and the customer can remove access when it is no longer required.
AnyDB runs on Amazon Web Services and uses managed cloud services, automated monitoring, protected backups, and tested recovery procedures to support the availability and integrity of customer data.
The standard SaaS service is hosted in AWS us-east-1 and is designed to use multiple Availability Zones where supported by underlying services.
Encrypted disaster-recovery backups use a rolling retention period of up to 90 days in the standard service’s AWS region.
Recovery procedures are tested through restoration and object-recovery exercises rather than relying only on backup completion.
Operational monitoring covers service health, errors, capacity, backup execution, and relevant security signals through AWS GuardDuty.
Private managed deployments can be provided in selected AWS regions for customers with specific residency, isolation, or regulatory requirements. Contractual service levels and deployment-specific recovery commitments are available for qualifying Enterprise deployments.
AnyDB gives people and AI access to the same connected business context while keeping permissions, approvals, and activity visibility under organizational control.
AnyDB does not use customer content, AI prompts, or AI responses to train, fine-tune, or evaluate AnyDB or third-party AI models.
AI features retrieve and act through permission-controlled AnyDB tools. Access is limited by user, workspace, record, file, and action permissions.
Organizations can require human approval for sensitive actions. AnyDB applies code-level permission and action checks rather than relying only on model instructions.
Information needed to complete a request may be sent to the selected AI provider under commercial data-protection terms. Supported configurations prevent inputs and outputs from being used for general model training.
When a customer connects an external AI service through MCP, the conversation remains with that service. AnyDB receives authenticated tool requests and returns only information permitted for that user and request.
Documented procedures support consistent handling of security events, access, continuity, suppliers, and assurance work.
AnyDB maintains a process covering reporting, triage, containment, investigation, recovery, customer communication, and post-incident review. Material customer-impacting incidents are handled according to contractual and legal notification requirements.
Continuity and recovery procedures cover cloud-service disruption, data restoration, communications, responsibilities, and recovery validation. Practices are reviewed after material architectural changes and test results.
Production infrastructure access is restricted to authorized personnel based in the United States, limited by role, and protected through AWS identity and access controls. Customer workspace access is granted by the customer under an invited support identity.
Service providers are assessed based on their services and the information they process. Applicable data-processing, confidentiality, security, and incident-coordination obligations are maintained with subprocessors.
AnyDB performs internal application-security testing and is developing its independent assurance program. Detailed evidence and security responses may be provided to qualified customers under appropriate confidentiality terms.
AnyDB uses a limited set of service providers to operate the platform. Subprocessors receive only the information necessary to provide their assigned service and are governed by applicable contractual and data-protection obligations.
The current subprocessor list is maintained in the Data Processing Agreement so customers have one canonical source for provider, purpose, and processing details.
Review public policies or request additional documentation for an active security, procurement, or deployment evaluation.
How AnyDB collects, uses, protects, retains, and discloses information.
Processing terms, international-transfer safeguards, and the current subprocessor appendix.
Contractual terms governing use of the AnyDB service.
Roles, SSO, record and field permissions, audit history, backup, and deployment options.
How administrators review important actions and request metadata.
The standard AnyDB SaaS service is hosted on Amazon Web Services in the us-east-1 region. Private managed deployments can be provided in selected AWS regions for customers with specific residency, regulatory, or isolation requirements.
Yes. AnyDB encrypts data in transit using TLS 1.2 or higher and uses AWS service encryption for customer data at rest. Private managed deployments may support additional encryption-key requirements by agreement.
No. AnyDB does not use customer content, prompts, or responses to train, fine-tune, or evaluate AnyDB or third-party AI models.
Yes. AnyDB supports GDPR requirements through its Data Processing Agreement, processing instructions, data rights, retention controls, subprocessor management, and contractual safeguards for international processing. Customers remain responsible for configuring and using AnyDB consistently with their own legal obligations.
AnyDB supports HIPAA-regulated workloads for eligible deployments under an executed Business Associate Agreement and an approved deployment configuration. Contact AnyDB before storing protected health information.
Not yet. AnyDB is implementing an information security management system aligned with ISO/IEC 27001:2022 and is working toward independent certification.
Yes. AnyDB supports Microsoft Entra ID and Okta through OpenID Connect. Qualifying deployments can enforce SSO-only access and use the identity provider’s multi-factor authentication controls.
Every request is authenticated and scoped to the appropriate team before data access is allowed. AnyDB then applies permissions at the workspace, record, file, and field or cell level. Customers use AnyDB application services rather than accessing underlying AWS data stores directly.
Encrypted backups are retained for up to 90 days. When information is deleted from active systems, residual encrypted copies may remain until they expire through the normal backup-retention cycle.
Yes. Customer records can be exported in standard formats, and files can be exported or transferred with assistance depending on volume. Customers may export data during their subscription and the applicable post-termination return period.
Yes. Enterprise customers can discuss private managed hosting or self-hosted deployment options, selected AWS regions, customer-managed encryption keys, and deployment-specific service commitments.
Tell us what your organization needs. We can provide detailed security information, discuss regulated or private deployments, and work through vendor-review requirements.
