> For the complete documentation index, see [llms.txt](https://docs.telm.ai/telmai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.telm.ai/telmai/security-and-compliance/overview.md).

# Overview

Telmai is built for teams whose data cannot leave their control. Data quality computations run where your data lives, and Telmai never copies raw records into its infrastructure. Telmai stores only derived results such as aggregate metrics, schema metadata, and monitor and incident records. A deterministic engine powers detection, and every AI capability operates under a governed policy that keeps humans in control. This section explains how the platform is secured, what data Telmai handles, and how our AI works, in enough detail to support a security review.

### Our Security Posture

Telmai maintains SOC 2 compliance and is continuously monitored against its security, availability, confidentiality, and privacy criteria.

All data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256. Access to production systems is restricted, role-based, and audited.

Telmai's AI capabilities are governed under a formal policy aligned to the NIST AI Risk Management Framework. The policy is built on one principle. No AI capability may take an action Telmai cannot explain, review, or reverse. The platform's full data quality function runs with AI disabled.

### Shared Responsibility

How responsibility divides depends on your deployment model.

<table><thead><tr><th>Responsibility</th><th>SaaS</th><th>VPC</th></tr></thead><tbody><tr><td>Application security, patching, and monitoring</td><td>Telmai</td><td>Telmai (software) and you (environment)</td></tr><tr><td>Infrastructure and network controls</td><td>Telmai</td><td>You</td></tr><tr><td>Data source credentials and scoping</td><td>You</td><td>You</td></tr><tr><td>User access, roles, and SSO configuration</td><td>You</td><td>You</td></tr><tr><td>AI feature configuration and review of AI output</td><td>You</td><td>You</td></tr><tr><td colspan="3"></td></tr></tbody></table>

See [Deployment Models](/telmai/deployment-models/deployment-models.md) for the full architecture of each option.

### What This Section Covers

[Platform Security](/telmai/security-and-compliance/platform-security.md) describes how the application and infrastructure are secured.

[Data Handling](/telmai/security-and-compliance/data-handling.md) describes what Telmai processes, what it stores, and for how long.

[AI Security And Governance](/telmai/security-and-compliance/ai-security-and-governance.md) describes our AI capabilities, the human oversight model, how AI handles your data, and the residual risks we ask you to understand.

[Common Security Questions](/telmai/security-and-compliance/common-security-questions.md) answers the questions we see most often in security reviews.

### Legal and Residency

The canonical legal and residency commitments live on telm.ai.

* [Privacy Policy](https://www.telm.ai/privacy-policy/)
* [Terms of Service](https://www.telm.ai/terms/)
* [Data Residency Commitments](https://www.telm.ai/data-residency/)

### Questions

For security questionnaires, compliance documentation, or anything this section does not answer, contact <info@telm.ai>.