Trust Center
Trust Center
Last reviewed: September 4, 2026
This page describes, in specific and honest terms, how Think4Ei approaches security, privacy, AI governance, and independent assurance. We deliberately avoid absolute claims like "100% secure" or "zero risk" — no real system can honestly make those guarantees. Instead, every item below is labeled with one of four statuses, consistently applied:
Implemented & internally verified Independently assessed In progress Planned
"Implemented & internally verified" means our own engineering team has built the control and confirmed it works
against real, live checks. It is not the same as an independent third-party audit — where we have
one of those, we say "Independently assessed" instead, and today we do not yet have a completed independent
security audit (see Assurance Status below).
Security overview
| Control | Status | What it means in practice |
|---|---|---|
| Encryption in transit | Implemented | Traffic to think4ei.com and the platform is served over HTTPS/TLS. |
| Encryption at rest | Planned | Full disk-level encryption for all underlying storage volumes is a tracked, planned improvement — it is not yet complete across every volume today, and we're not going to claim otherwise. |
| Tenant isolation | In progress | The platform enforces tenant-scoped, fail-closed access checks by design across its systems. We run a dedicated, ongoing tenant-isolation hardening program that actively scans for and closes gaps as part of routine operations — this is real, continuous work, not a one-time pass we consider finished. |
| Role-based access control (RBAC) | Implemented | Elevated or sensitive actions (approvals, role changes, financial holds, and similar) are gated by server-computed permission checks tied to a verified session, not a client-side toggle. |
| Audit logging | Implemented | Sensitive actions across the platform write to an audit log used for traceability and incident investigation. |
| Document/record integrity sealing | Implemented | Ingested documents and records are cryptographically sealed (merkle-hashed) at intake by our internal "Sentinel" mechanism, so tampering with a sealed record after the fact is detectable. |
| Vulnerability & penetration testing | Planned | A focused third-party penetration test is planned alongside our formal audit engagement (see Assurance Status). We have not yet had one completed by an outside firm. |
Privacy & data governance
Our approach to privacy is described in full at the Privacy Policy and, for client platform data, the Data Processing Agreement. A few specific, verifiable practices:
- Ingest-then-seal discipline Implemented — data ingested into the platform is routed through the Sentinel sealing step described above before further processing, by design, on every ingestion path we've built.
- Education-sector (FERPA-relevant) handling In progress — for education clients, the platform's sealing and tenant-isolation mechanisms are designed with the intent of protecting student, faculty, and staff record rights; this is architectural intent backed by real mechanisms, not a claim of formal FERPA certification (FERPA compliance is fundamentally a shared institutional responsibility, not something a vendor can unilaterally certify on a client's behalf).
- Behavioral analytics governance Implemented — see Cookies & Analytics Notice for the specific fields captured, salted-hash IP handling, and the fact that typed field values are never captured.
- Data-classification & retention schedule (written policy) In progress — the technical substance (sealing, tenant isolation, PII hashing) is real and operating; a formal, published data-classification scheme and retention schedule document is still being finalized.
AI governance
- Server-side model access only Implemented — AI model credentials are never exposed client-side; every AI feature is proxied through our own backend. See AI Disclosure.
- Human-in-the-loop for consequential actions In progress — many platform workflows with real consequences are built with an explicit human approve/reject step rather than a fully automatic AI action; this pattern is applied where we've built it, and extending it consistently across every workflow fleet-wide is ongoing work, not yet claimed as universal.
- Grounded-knowledge sourcing discipline In progress — where the platform's internal knowledge-ingestion layer is used to ground an AI answer, our internal policy restricts that layer to peer-reviewed, published scholarship (no general web scraping, no unreviewed sources) — this governs what the knowledge layer is allowed to ingest, and does not by itself guarantee every AI response fleet-wide is fully citation-backed today; automatic source-citation display is expanding across features, not yet complete on every surface.
- We do not claim AI outputs are error-free. We describe AI limitations plainly at AI Disclosure rather than using language like "anti-hallucination" or "AI cannot make mistakes" — it can, and when it does, we want to hear about it.
Assurance status
We do not hold SOC 2, ISO 27001, FedRAMP, or any other completed independent security certification today.
Any statement elsewhere that could be read to imply otherwise is wrong and should be reported to
support@think4ei.com so we can correct it.
- Internal SOC 2 readiness self-assessment In progress — we maintain an internal, honest self-assessment against SOC 2 Trust Services Criteria to guide our own engineering priorities. This is a self-assessment by our own team, explicitly not a substitute for an independent audit, and we do not present it as one.
- SOC 2 Type 1 engagement Planned — targeted for third-quarter 2026, with an independent, licensed audit firm. Not started as of this page's last review date.
- ISO 27001 engagement Planned — targeted alongside the SOC 2 engagement above. Not started as of this page's last review date.
- Independent penetration test Planned — expected alongside the audit engagements above.
- Independent WCAG 2.2 AA accessibility audit Planned — see Accessibility Statement for our current, honestly-labeled accessibility status.
When any of the above moves from Planned to Independently assessed, this page — and only this page's real, dated status — is what we'll point to as evidence. We will not describe a "Planned" item as complete anywhere else on the site.
Security reporting
Found a security issue? We want to know. See our Security Reporting policy for scope and how to report responsibly.
Questions
Email support@think4ei.com or sales@think4ei.com for anything not covered here, including vendor-security questionnaires.