Your data never trains a model
Vendor submissions and RFP content are used only to score your evaluations, never to train or fine-tune any AI model.
HillStar Security Overview
Your data is secure with HillStar.
HillStar keeps sensitive RFPs and vendor responses secure through encryption and isolated workspaces. We will never train on your data.
SOC 2 compliance
All sub-processors are SOC 2 certified, with our own certification expected Q3 2026.
End-to-end encryption
Data is encrypted in transit (TLS 1.3) and at rest (AES-256), hosted entirely in the United States.
Access controls
Role-based permissions and workspace isolation, with every action logged and timestamped for review.
Explainable scoring
Every evaluation links back to its source evidence and the reasoning that produced it.
Security by design
Enterprise‑grade security
Security is built into every layer of HillStar, from infrastructure and workspace isolation to model usage, access controls, and independent testing.
US-only, end to end
Your data never leaves the United States. Document processing, storage, and AI inference are pinned to US-region infrastructure — enforced in code, not just policy, and verified on every deploy. Other regions may be supported with an enterprise agreement.
Workspace isolation by default
Every project, file, and score is scoped to your workspace. Access is verified on each request against workspace membership and role — no shared links, no cross-tenant leakage, all access logged.
Independently audited
HillStar undergoes semi-annual third-party penetration tests covering the full platform, backed by continuous SAST scanning and image-level vulnerability monitoring across our entire registry.
Built on trusted infrastructure
HillStar runs on Google Cloud and uses its managed infrastructure and encryption controls.
Quick Answers
These same answers, plus how evaluations and scoring work, are on the frequently asked questions page.
| Question | Answer |
|---|---|
| Can other customers see my data? | No. Strict workspace isolation at the database and API layers. |
| Can HillStar employees see my data? | No. Access requires explicit customer permission for support. |
| Where is my data stored? | Google Cloud Platform, US region. |
| Is my data encrypted? | Yes. At rest (AES-256) and in transit (TLS 1.3). |
| Does AI training use my data? | No. HillStar will never train on your data. Our AI partners do not use commercial prompts or outputs for model training by default. |
| Do you have SOC 2? | SOC 2 is in progress, with completion targeted for Q3 2026. HillStar Trust Center |
Visit the HillStar Trust Center
Review our security, privacy, compliance, and data-handling practices in one place.