Security, privacy and controls
How SightLift uses your AI conversation data, how it treats conversation text, and how the platform protects it.
How SightLift uses your data
SightLift reports AI usage by team from labels like topic and token counts. Conversation text stays closed by default.
What reports show
- Topics and trendswhere AI takes hold
- Skills that workusage and acceptance
- Cost and valuespend against output
- Team-level rollupslike headcount and budget
What reports leave out
- Conversation textclosed by default
- Non-work topicscost totals only
- Sensitive detailbehind full text access
- Any one person's scoreteam and org scores only
Topic, complexity, tokens and skill usage feed the map and the score.
Model training and benchmarks
Your data doesn't train models
- No foundation models
- No fine-tuning
- No classifiers trained on your data
The same holds for our AI subprocessors.
We don't sell your data
We use aggregated, de-identified data for benchmarks and product improvement. We don't re-identify it, and we don't publish or share anything that identifies your company or anyone in it.
We scope each setup to your needs, under our DPA, Privacy Policy and Terms of Service.
Access and content controls
SightLift surfaces the patterns and actions that matter, so no one has to wade through conversations.
Protection: off-limits and sensitive topics
Personal topics like health and religion are never shown to anyone. Sensitive work, such as HR, legal, finance and deals, needs special access to open.
Access: off until you grant it
People see only their own data by default. Admin is a setup role with no data access, and support has no standing access. SightLift logs who opens what in the product.
Scope: whose data a person sees
Everyone has the right to see only their own data. Scope can be widened for department heads or company leaders, one person at a time.
Depth: how much they see within it
By default, no one, not even an admin, can see conversation text. Content types, full text access, protected people and walled matters each limit what a person sees.
Architecture and security
How SightLift encrypts, separates and limits access to your data, and the documents your reviewers can request.
Encrypted at rest and in transit
AES-256 at rest, with managed keys. TLS 1.2 or higher in transit, with 1.3 enabled.
Row-level security separates every customer
AWS, in the United States. The database enforces it on every customer request.
Access runs on least privilege
Individual accounts, MFA on production. Reviewed quarterly, revoked on departure.
Compliance program and documents
Our compliance program is built for SOC 2 Type II and ISO 27001, 27701, and 42001 alignment
- Versioned policies, procedures, and risk registers
- Operational evidence that backs each one
- Annex II measures verified against the live system in July 2026
You get our DPA
- Processing details
- Technical and organizational measures
- Subprocessor list
Request our policies under NDA
- Information Security
- Access Control
- Incident Response
- Privacy and Data Protection
- Vendor Management
- BC/DR
- AI Governance
Send us your questionnaire
SIG, CAIQ, or your own format, completed promptly. Send it to [email protected].
Talk it through with us
Email [email protected]Vulnerability reports go there too, and privacy requests to [email protected].