Question 1

Which AI providers do you use?

Accepted Answer

Canero uses leading AI providers under zero-data-retention agreements. Your data is processed for analysis only - it is never stored by the AI provider or used to train any model. We maintain formal contractual terms with all AI providers governing data handling.

Question 2

What is your data retention policy?

Accepted Answer

Raw conversations are purged automatically after 90 days. Aggregated analytics - scores, theme movements, rollups - may be retained longer as they contain no individual-level data. Full GDPR erasure is supported, including the ability to process right-to-erasure requests at any time.

Question 3

How is data encrypted?

Accepted Answer

All data is encrypted at rest using AES-256. All data in transit is protected with TLS 1.3. Encryption keys are managed via cloud KMS with no unencrypted storage of sensitive data at any layer.

Question 4

Who can access our organization's data?

Accepted Answer

Only authorized users within your organization can access your data through the Canero application. Canero staff cannot access customer data without initiating a formal break-glass procedure, which is time-limited and fully audited. There is no standing access to customer data by any Canero employee.

Question 5

What compliance certifications do you have?

Accepted Answer

Canero is GDPR-compliant with a Data Processing Agreement available upon request. SOC 2 Type II certification is in progress, with target completion within 12 months. We support standard security questionnaires including SIG, CAIQ, and HECVAT.

Question 6

How do you handle PII in conversations?

Accepted Answer

PII is automatically detected and scrubbed from conversation content before storage and before any AI processing. The scrubbing pipeline uses multiple detection methods. The system is fail-closed - if the PII scrubber is unavailable, the conversation pipeline stops rather than allowing unscreened content to proceed.

Question 7

Can you complete a security questionnaire?

Accepted Answer

Yes. We complete SIG, CAIQ, HECVAT, and custom security questionnaires for prospective enterprise customers. Contact us through the demo booking flow or company contact page and we'll get the right person to respond.

Question 8

Where is data stored geographically?

Accepted Answer

By default, Canero stores data in the United States. Data residency options for EU and other regions are on the roadmap. If specific data residency requirements are a blocker, please contact us - we can discuss options.

Question 9

What are your key subprocessors?

Accepted Answer

Canero uses cloud infrastructure providers, AI providers (under ZDR agreements), and authentication services as key subprocessors. A full subprocessor list is available under the Data Processing Agreement provided to enterprise customers.

Security and privacy questions for enterprise teams

Ready to complete your security review?