Built to handle confidential M&A data.

Taia has completed its SOC 2 Type 1 examination across all five Trust Services categories — Security, Availability, Confidentiality, Processing Integrity and Privacy. The report is available to customers under NDA.

All traffic to and from the platform is encrypted in transit using TLS 1.2 or higher. Customer Data at rest is encrypted using AES-256 via our infrastructure providers.

Customer credentials are never stored on Taia infrastructure; authentication uses short-lived tokens issued by our auth provider. Secrets and API keys are stored in managed secret stores, never in source code or logs.

Authentication is enforced with mandatory multi-factor authentication for all accounts with production access. Production access is restricted to a documented set of personnel with role-based privileges and a clear business need.

Staff access to customer deal data through the platform’s authenticated interface is limited, logged, and reviewed. Access is reviewed quarterly and revoked within one business day of offboarding.

Customer Data is hosted on infrastructure located in the United States. Each client’s data is contained in its own isolated workspace.

Customers do not have direct database access; all data flows through Taia’s authenticated platform. Infrastructure providers carry SOC 2 Type II or ISO 27001 attestations.

Your deal data remains within your workspace. Taia does not sell, share, or surface it in any other client’s work, does not use it to create benchmarks, and does not use it to train AI models.

Where Taia uses third-party large language model providers, those providers operate under enterprise terms that prohibit training on customer inputs. Our LLM provider has zero data retention configured.

Customer Data is retained for the duration of your subscription. On contract termination or written deletion request, hard deletion completes within 7 days, reflecting our database provider’s rolling backup retention window.

A current list of sub-processors, the data they receive, and links to their data processing terms is provided to customers under mutual non-disclosure as part of vendor due diligence. Email privacy@taiatech.com to request a copy.

Taia will notify customers of sub-processor changes at least 30 days in advance, providing the right to object.

Dependencies are monitored for known vulnerabilities through automated tooling. Incident response procedures are in place; a summary is available to customers on request under mutual NDA. Security incidents affecting Customer Data will be communicated to the affected customer within 72 hours of Taia becoming aware.

Responsible disclosure of suspected vulnerabilities is welcome at security@taiatech.com.