HillStar Security Overview

Your data is secure
with HillStar.

HillStar keeps sensitive RFPs and vendor responses secure through encryption and isolated workspaces. We will never train on your data.

SOC 2 compliance
All sub-processors are SOC 2 certified, and HillStar is SOC 2 Type I compliant.
End-to-end encryption
Data is encrypted in transit (TLS 1.2+) and at rest (AES-256), hosted entirely in the United States.
Access controls
Role-based permissions and workspace isolation, with every action logged and timestamped for review.
Explainable scoring
Every evaluation links back to its source evidence and the reasoning that produced it.

Compliance

Enterprise-Grade Security and Controls

Security by design

Security is built into every layer of HillStar, from infrastructure and workspace isolation to model usage, access controls, and independent testing.

01
Your data never trains a model
Vendor submissions and RFP content are used only to score your evaluations, never to train or fine-tune any AI model.
02
US-only, end to end
Your data never leaves the United States. Document processing, storage, and AI inference are pinned to US-region infrastructure — enforced in code, not just policy, and verified on every deploy. Other regions may be supported with an enterprise agreement.
03
Workspace isolation by default
Every project, file, and score is scoped to your workspace. Access is verified on each request against workspace membership and role — no shared links, no cross-tenant leakage, all access logged.
04
Independently audited
HillStar undergoes semi-annual third-party penetration tests covering the full platform, backed by continuous SAST scanning and image-level vulnerability monitoring across our entire registry.
05
Built on trusted infrastructure
HillStar runs on Google Cloud and uses its managed infrastructure and encryption controls.

These same answers, plus how evaluations and scoring work, are on the frequently asked questions page.

Question	Answer
Can other customers see my data?	No. Strict workspace isolation at the database and API layers.
Can HillStar employees see my data?	No. Access requires explicit customer permission for support.
Where is my data stored?	Google Cloud Platform, US region.
Is my data encrypted?	Yes. At rest (AES-256) and in transit (TLS 1.2+).
Does AI training use my data?	No. HillStar will never train on your data. Our AI partners do not use commercial prompts or outputs for model training by default.
Do you have SOC 2?	Yes, HillStar is SOC 2 Type I compliant. HillStar Trust Center

Trust Center

Review our security, privacy, compliance, and data-handling practices in one place.