Rate tables, contracts, and invoice data need careful handling. This page documents every layer of our security architecture, technical facts, no marketing.
Encrypted In Transit Encrypted At Rest Mutual NDA First Zero AI Training Deletion On Request
Layer 1
Data in Transit: Encryption on the Move
All connections to Trazai are encrypted with modern TLS (1.2+), provided and continuously updated by our hosting platform.
Invoice uploads require an authenticated session and use single-use signed upload URLs scoped to your account. Files travel over the encrypted TLS channel.
In plain terms: From upload, your contracts and invoice files travel over an encrypted channel that can't be intercepted in transit.
Layer 2
Data at Rest: Storage Compartmentalization
All stored client files (parsed invoice data, normalized tables, rate card mappings) are encrypted at rest (AES-256) by our cloud infrastructure.
Data is logically isolated per client tenant. Your DHL rate schedule is only visible inside your tenant environment, inaccessible to other clients.
Per-tenant isolation: Every record and file is scoped to your organization and enforced at both the application and database layers.
Encryption at rest: Industry-standard AES-256 encryption applied by our infrastructure to stored files and database.
Infrastructure: Hosted on enterprise cloud infrastructure (AWS, US-East). Client files are stored under per-organization namespaces.
Layer 3
Artificial Intelligence: Execution Boundaries
This is what most CFOs ask about. Our commitments:
Zero Model Training: Your carrier rates, invoice data, and contract terms are never used to train any AI model. Contractual guarantee.
Scoped processing: Documents are processed inside your tenant. Extraction outputs are stored only within your organization's encrypted environment.
Isolated processing jobs: Each document is processed in an isolated job that loads only that document's data; no job has access to another's working data.
Subprocessors: We use Anthropic (extraction), Mistral (OCR), and Supabase/AWS (hosting & storage). Their contracts prohibit using client data beyond delivering our service. A current subprocessor list is available on request.
Anonymized benchmarking only: Our carrier benchmarks are computed from anonymized, aggregated rate data across clients. No client's identifiable rates, contracts, or invoices are ever exposed to another client or used to train any model, benchmarking uses only fully anonymized, non-identifiable statistics.
Plain terms: We use AI to parse invoice data faster. It never learns from your data. Your rate tables are not inputs to any training pipeline.
Layer 4
Compliance & Retention Logic
Retention: We retain invoice and audit records for the duration of your engagement. Custom retention periods can be agreed contractually, and we delete client data on request.
Deletion on termination: On termination, we delete client data and files on request. Backups age out on our provider's standard cycle.
Regional Compliance: We operate as a Data Processor under Mexico's LFPDPPP, Colombia's Statutory Law 1581, and EU GDPR where applicable.
We execute a Mutual NDA before any file is shared. Your rate tables, logistics margins, and carrier agreements are classified as Highly Confidential and legally protected throughout the engagement.
Your data is never shared with carriers outside of client-approved dispute workflows. No rate structure or contract terms reach any third party.
Data Minimization: We ingest only what's needed for the audit, carrier invoices, rate cards, and shipment manifests.
No Subprocessor Exposure: All subprocessors operate under contractual confidentiality and data-use restrictions.
Start Your Free Audit
Encrypted transport, per-tenant isolation, and a mutual NDA from the first file you share.