ConductScience Enterprise
Security and data handling
Your security team can check where each ConductScience product runs, who can sign in and which documents we provide.
Last updated
01
Where our products run
At your site
- ConductVision analyzes camera video on a computer at your site.
- ConductCompliance has an offline edition that runs on your own servers and keeps its records there.
Hosted in our cloud
- Our hosted products, such as ConductColony, ConductCommons and the hosted edition of ConductCompliance, run in United States data centers on Vercel, Neon, Microsoft Azure and our own servers at InMotion Hosting.
02
Sign-in
Sign-in methods
Each person has one ConductScience account and signs in with Google, Microsoft, ORCID, or an email address and password.
Single sign-on
Your organization can connect its identity provider through SAML single sign-on.
Microsoft sign-in
When someone signs in with Microsoft, Microsoft checks the password, so we never see it. Microsoft also applies your organization's multi-factor authentication and conditional access rules.
Offboarding
If someone signs in through your identity provider, disabling their account there stops them from signing in.
03
Records, roles and change control
These controls cover ConductCompliance and the records ConductVision makes from camera video.
Human review
ConductVision flags events in camera video. A trained reviewer on your team decides on each flagged event.
Roles
Each person has a named account with one role, and the system checks that role on every action.
Audit trail
The audit trail records the person, role and time of every decision. Its entries cannot be changed or deleted.
Signatures
A reviewer signs each report, and a different person approves it.
Change control
The models that flag events change only in a new release. Each release comes with a record you can file in your change control process.
04
Encryption
In transit
TLS protects data moving between browsers, the computer at your site and our servers.
At rest
Databases on Neon and Microsoft Azure are encrypted at rest with AES-256. Each provider manages its keys.
05
Camera video and remote access
Recordings
Full recordings stay on your network. Short clips leave it only as your statement of work sets out, for example for review in a browser. Clips that reach us go to our Microsoft Azure environment in the United States, where ConductScience's own detection model learns from them.
Remote access
Our engineers can reach the computer at your site only when your IT team grants them access. Your IT team can turn that access off.
Operator privacy
Reports identify each operator on camera with a label such as Subject 8. Operator names never appear in these reports.
06
Subprocessors
These companies host or process customer data for our products or our own operations.
| Service | What it does | Where |
|---|---|---|
| Microsoft Azure | Hosts some of our products and their databases | United States (East US 2) |
| Vercel | Hosts our websites and hosted products | United States (US East) |
| Neon | Runs managed PostgreSQL databases | United States (US East) |
| InMotion Hosting | Runs our dedicated servers, including the online store and some hosted products | United States |
| Resend | Sends notification emails | United States |
| Anthropic | Writes answers in some products' in-app assistants | United States |
| Google Workspace | Runs company email, calendars and documents | Google data centers |
| Cloudflare | Delivers and protects conductscience.com | Worldwide network |
Outside AI companies never train on your data. That includes Anthropic, which writes answers in some products' in-app assistants.
ConductColony and ConductCommons each have a security page that lists the subprocessors that product uses.
07
Documents for your security team
Ask your ConductScience contact or email info@conductscience.com for any of these, under a confidentiality agreement if you need one.
- Architecture and data flow for your setup
- Data processing agreement
- Certificate of insurance
Report a security problem
Email info@conductscience.com with Security in the subject line.
Send us your security questionnaire
We answer SIG Lite, CAIQ, HECVAT or your own questionnaire in writing.
