Trust
Your customers trust you with their conversations. We built 42A so that trust is never misplaced.
42A brings your company into the AI assistants your customers already use, through the open Model Context Protocol (MCP). Every conversation belongs to you and your customers, never to us. Security and privacy weren’t added at the end. They are the rules the platform is built on.
SOC 2 In progress 
GDPR Compliant 
CPRA (formerly CCPA) Compliant Security
Privacy
42A runs in multiple regions, and each company chooses where its data lives. Your conversations, customer profiles, backups and AI processing stay in that region. Each region runs on its own, with its own database and encryption keys.
When your customers use their AI assistant, we never see their chat, their files or their assistant’s memory. The assistant sends only what a request needs, such as an amount and a country, plus a one-line summary of what the customer wants.
and they sign in with your login, not ours. We never see their passwords.
Conversations are deleted automatically after 90 days by default, or on the schedule you choose.
Guardrails
These are the rules every part of 42A follows. They are enforced by the platform, not left to good intentions.
We never sell your data, and we never use it for advertising.
We don’t train AI models on your data.
Personal details never reach the AI. Names, email addresses, phone numbers and account numbers are removed before a message is sent to a model.
Data never leaves its region. Each region stores your data and runs its AI models inside that same region.
Every company is walled off. Data is isolated with row-level security inside the database itself, not just in our code, and each region turns away companies that belong to another.
The assistant only goes where you allow. It calls only the systems and websites you name, over HTTPS, with built-in protection against server-side request forgery (SSRF), so it can never reach private networks.
Customers can’t act as you. Tools meant for your team are hidden from and refused on every customer channel.
Identity is verified, never assumed. A customer is a guest until they sign in with your login through OAuth 2.1 with PKCE, and every sign-in is checked with your identity provider.
Nothing sensitive in our logs. Passwords, tokens and secret headers are stripped before anything is written.
Control
Tools to meet your own obligations, built into the console:
Erase a customer in one step: conversations, activity, profile and sign-in access.
Forget what the assistant learned about a customer, and stop it learning it again.
Set your own retention period for conversations and activity.
Bring your own customer login, with any OpenID Connect (OIDC) identity provider.
Control your team with admin and member roles.
A full audit of the assistant’s actions: every tool it called, what it did and whether it worked.
Take everything with you if you ever leave. We export all your data, then delete it.
Trust Center
Visit the Trust Center for our reports, policies and subprocessor list. For anything else, write to [email protected].