Data Privacy

Overview

At Needle, we believe that your data should remain yours. Our data privacy framework is built on these core principles:

• No Data Training: Your data is never used to train our models.
• Complete Isolation: Each customer's data is logically isolated.
• Your Infrastructure: Get in touch with us for a dedicated set-up.

Storage & Data Isolation

Where your data lives, how it is processed, and how we keep every customer's data completely separate.

Storage

• Separate storage buckets for each customer.
• Isolated vector database indices with no cross-customer data access.
• Data Encryption.

Processing

• Dedicated processing queues with isolated embedding processes.

Data Retention

• Zero data retention by us.
• Immediate data deletion on request.

Security Architecture

Every layer of Needle's infrastructure is built with security as a core requirement, not an afterthought.

• ISO-compliant security architecture across every layer.
• Enterprise-grade data protection and auditing.

Infrastructure

• Secure API Gateway for ingress, authentication, and throttling.
• Processing Engine with isolated ingestion, transformation, and retrieval.
• Vector Database optimized for semantic understanding.
• Dedicated Security Layer for monitoring, logging, and governance.
• Hardened cloud infrastructure with end-to-end encryption in transit and at rest.
• Regular third-party security reviews.

Data Flow

• Secure data ingestion pipelines normalize and validate content.
• Processing and vectorization happen within isolated environments.
• Secure storage maintains data residency and retention guarantees.
• Controlled access ensures every retrieval is auditable.

Access Controls

How we manage and control access to your data at every level.

Authentication

• Secure token-based authentication with rotating credentials.
• Unique API endpoints per customer with separate authentication contexts.
• Optional SSO integration.
• Multi-factor authentication support.

Authorization

• Role-based access control (RBAC) down to dataset level.
• Granular permission settings with custom access policies.
• Isolated rate limiting per customer.
• Transport-level encryption and request signing.

Audit Logging

• Comprehensive access logs for every API call.
• Activity monitoring across all operations.
• Automated logging with configurable retention policies.

Compliance

Needle is built for organizations that cannot compromise on compliance, residency, or auditability.

• ISO-aligned policies and continuous monitoring.
• Configurable data residency to meet regional mandates.
• Documentation and controls ready for enterprise audits.
• End-to-end encryption and secret management.
• Segmented infrastructure to isolate sensitive workloads.
• Automated logging with retention policies for forensics.