Security & trust
Built for enterprise architecture content — and the models that touch it
DecisionPen holds living landscape context: documents, factsheets, and Ask conversations that often contain sensitive IT design. Security reviewers should not have to reverse-engineer a blog post to learn how we treat that data. This page is the public summary; questionnaires and DPAs are available for enterprise evaluation.
AI & LLM data controls
The LLM does not learn from your customer data
DecisionPen uses Google Cloud Vertex AI for production modelling and Enterprise Ask. Under Vertex AI generative AI data governance, customer prompts and responses are not used to train Google foundation models by default. Your HLDs, transcripts, and Ask threads are inputs to your workspace — not fuel for a public model training run.
No training on your prompts or responses
Customer prompts and model responses are not used to train Google foundation models by default under Vertex AI generative AI data governance. Your architecture content is not a training corpus for the public model.
Enterprise inference plane — not consumer API keys
Production Ask and modelling use Google Cloud Vertex AI in a regional Google Cloud project under enterprise Google Cloud terms / DPA. We do not route enterprise traffic through consumer Gemini API-key channels.
Tenant-scoped retrieval before the model sees context
Authenticated users only; DecisionPen retrieves catalog and evidence for that tenant before building a prompt. Isolation starts in the application layer, not only at the model boundary.
Encryption in transit to the model
Prompts travel to Vertex AI over TLS using Google Cloud application credentials / workload identity — not ad-hoc public endpoints.
Logs keep metadata, not prompt bodies
Operational logs record tenant, model, latency, and success — not full prompt or response bodies — so day-to-day observability does not become a second copy of your architecture text.
Configurable chat retention
Ask/chat text stored for product history uses a configurable retention window (default 30 days; enterprise can lower). Landscape model and evidence remain under your workspace governance.
IDE / agent boundary: if you connect DecisionPen evidence into a host IDE or MCP agent, cite-only document text may reach that host’s model. For confidential corpora, use a controlled agent runtime and your organisation’s approved model path.
Access control — SSO and RBAC when you want them
Light trials can start with Google sign-in. When you are ready for enterprise access patterns, administrators can enable company SSO and assign roles so landscape data is not an all-or-nothing shared inbox.
Company SSO (optional)
Enterprise organisations can wire DecisionPen to their identity provider — for example Okta, Microsoft Entra ID, or another OIDC / SAML-class IdP — so people sign in with corporate credentials. SSO is configured per organisation (Admin → Company SSO); ask your DecisionPen contact to enable it for your tenant if it is not already on. Google sign-in remains available for light trial signup and staff fallback where appropriate.
Role-based access (RBAC)
Roles control which menus and actions each person sees. Workspace administrators assign roles under Admin → Users & roles:
Viewer
Browse the map, reports, and Ask — without Add knowledge or Inbox publish rights.
Contributor
Add knowledge, review proposals in Inbox, and edit the map as your policies allow.
Administrator
Configure item types, hierarchies, users & roles, import/cleanup (including clearing map and Ask history), and company SSO.
Approver
Handle baseline / approvals queues where your organisation separates L1/L2 review from day-to-day Inbox curation.
Self-serve clear map & Ask history sits with Administrators (Import & cleanup) so trial or sensitive slices can be wiped without waiting on a ticket — permanently for that workspace content, with confirmation before it runs.
Audit & observability
Fortune 500 reviewers ask who changed the landscape and how you watch the AI path. DecisionPen gives administrators exportable security events and keeps model observability away from prompt bodies — without pretending to be your SIEM.
Security event export
Administrators can load and download tenant security events from Admin → Security & audit (SSO, SCIM, admin actions, and agent write proposals) for compliance reviews and your own retention tooling.
Product and agent audit trail
Meaningful map and curation activity is recorded so changes are attributable. Agent tool use is audited so automated writes are not anonymous — humans remain accountable for what joins the living map.
LLM operational observability
Platform logs for model calls record metadata such as tenant, model, latency, and success — not full prompt or response bodies — so day-to-day monitoring does not become a second copy of your architecture text.
What this is not
DecisionPen is not a customer-facing SIEM, SOC dashboard, or guaranteed long-term WORM archive. We operate on Google Cloud logging for our own reliability and security operations; deeper log-sharing arrangements can be discussed under enterprise evaluation.
Platform controls (summary)
Buyer-facing posture — not a network diagram. Deeper technical detail is shared under NDA with security teams.
- Encryption in transit
- TLS for client traffic and for calls to Vertex AI and other Google Cloud services.
- Encryption at rest
- Yes — via provider platform encryption. The primary database (Neon / managed Postgres) and Google Cloud Storage use the cloud providers’ default encryption at rest. Sensitive IdP client secrets are also encrypted at rest in the application (Fernet). Customer-managed encryption keys (CMEK) are not offered on the current SaaS posture; we will say so explicitly when CMEK becomes available for a given store.
- Tenant isolation
- Application-level tenant separation on SaaS. Regulated customers can run a dedicated Google Cloud project for stronger isolation.
- Data residency (default)
- SaaS defaults to the US East metro for primary datastore and Vertex inference. Dedicated postures stay in the same metro unless otherwise agreed.
- Secrets
- Credentials and secrets are held in Google Secret Manager — not in application source or client bundles.
- Access control
- Company SSO and role-based access (RBAC) are available when you want them — see Access control below. Security questionnaires and DPAs are available for enterprise evaluation.
- Audit & observability
- Administrators can export tenant security events; product actions leave audit trails; LLM ops logs stay metadata-only. See Audit & observability below — this is not a customer SIEM product.
Deployment postures
- SaaS (default) — Shared DecisionPen Google Cloud project with regional Vertex inference and application tenant isolation.
- Dedicated — Per-customer Google Cloud project for organisations that need stronger separation of inference and storage. Available for enterprise agreements.
LLM-relevant subprocessors
Short list for security questionnaires. A fuller subprocessor / DPA pack is available on request.
Google Cloud Platform
Hosting, storage, Secret Manager, logging
Google Cloud Vertex AI
Generative and embedding inference for modelling and Ask
Neon (AWS)
Managed Postgres colocated in the US East metro with our default GCP region
What this page is — and is not
This is a trust summary for CTOs, CISOs, and procurement. It does not replace a signed DPA, a completed security questionnaire, or your organisation’s own risk assessment.
We do not list unverified certification badges here. Ask us for the current attestation and questionnaire status during enterprise evaluation.
Personal-data rights and cookie practices are covered in the Privacy Policy. Product behaviour and fit are covered on Product.
Evaluating DecisionPen for a regulated environment?
Send a security questionnaire or request the enterprise pack — or start a trial on a non-sensitive landscape slice first.
Opens the contact form with a security questionnaire / DPA request started for you.