We work inside your business. Here's exactly how we protect it.

Fellowship AI is a consulting firm and does not itself hold SOC 2, ISO, or HIPAA certifications. We build on providers that do, and we say so specifically rather than implying otherwise.

ANTHROPIC · INHERITED

SOC 2 Type II · ISO 27001 & ISO 42001 (AI management) · HIPAA-eligible under a BAA · no training on API customer data

AWS · INHERITED

SOC 1/2/3 · ISO 27001 · PCI DSS · HIPAA-eligible · GDPR-compliant data processing

FELLOWSHIP AI · HELD

No certifications held directly, stated plainly. Our own controls: least-privilege access, encryption at every layer, isolated environments, scrubbed logs.

ON REQUEST

DPA (same-day, usually) · sub-processor list (published on Data Governance) · your vendor security questionnaire, completed directly

IS MY DATA USED TO TRAIN ANY AI MODEL?

No. We use enterprise and API tiers from our AI providers, which contractually prohibit using your inputs or outputs to train their models. Your business data is processed to do your work, and nothing else.

DO YOU HOLD SOC 2, ISO, OR HIPAA CERTIFICATIONS YOURSELVES?

No, and we won't tell you otherwise. Fellowship AI is a consulting firm and does not itself hold a SOC 2, ISO, or HIPAA certification. We achieve a strong compliance baseline by building on providers that do: Anthropic and AWS.

"INHERITED" VS "HELD" COMPLIANCE · WHY IT MATTERS

"Held" means an independent auditor examined our own control environment and certified it. "Inherited" means we build on infrastructure and models whose providers hold that certification, and we operate within the controls they provide. A vendor claiming a certification it doesn't actually hold is a real risk in this industry. We'd rather be precise about which is true for us today than let the distinction blur.

WHAT HAPPENS TO OUR DATA IF WE END THE ENGAGEMENT?

You choose: we return your data in a portable format, delete it, or both. We revoke our access to your connected systems, rotate or destroy stored credentials, and remove operational data from our environment within 30 days of offboarding, except records we're legally required to retain. On request, we provide written confirmation of deletion.

WHO INSIDE FELLOWSHIP AI CAN ACCESS OUR SYSTEMS?

Only the team members assigned to your engagement, on a need-to-know basis. Access is granted with least privilege, logged, and revoked when an engagement ends or a team member rolls off. Automated systems access only the specific scopes their task requires.

DO YOU EVER ASK FOR ADMIN-LEVEL ACCESS?

No, not as a default. We request only the scopes a system needs, and we don't ask for blanket admin access when read-only or a single scope will do.

HOW ARE OAUTH TOKENS AND API KEYS STORED?

Where a provider offers OAuth, we use it so you grant scoped access without handing us a password. Tokens are stored encrypted, scoped to the minimum required permissions, refreshed automatically, and revocable by you at any time. Where a provider only supports API keys, those are encrypted at rest and rotated on offboarding.

IS DATA ENCRYPTED IN TRANSIT AND AT REST?

Yes. All traffic to our systems and the third-party services we integrate is encrypted with TLS 1.2+. Stored data and backups are encrypted using AES-256, backed by AWS-managed keys on encrypted volumes.

CAN WE GET AN ON-PREMISE DEPLOYMENT?

Yes, for Executive Installation clients. Each client's systems run in an isolated environment by default, and full on-premise deployment is available where an engagement calls for it. For new AIOS builds specifically, we deploy the AI runtime, encryption keys, and data storage inside your organization's own AWS account, not ours.

SUB-PROCESSOR LIST?

Yes, published in full on our Data Governance page: Anthropic, AWS, Cloudflare, Google Workspace, OpenAI (where used), and the client platforms you specifically authorize. We'll inform clients of material changes to this list.

IS A DPA AVAILABLE?

Yes, on request, including for GDPR- and CCPA-exposed clients. It sets out processing terms, sub-processor commitments, and the security measures described on our Data Security page. Email support@fellowshipautomation.com and we'll send it.

INCIDENT-RESPONSE PROCESS?

If we become aware of a security incident affecting your data, we investigate promptly, contain it, and notify you without undue delay with what we know and what we're doing about it. We rotate any potentially exposed credentials, document the root cause, apply fixes so it doesn't recur, and coordinate with you on any disclosure your own compliance obligations require.

IRS PUB 4557 / §7216 / WISP FOR TAX FIRMS?

We take this seriously, and we won't claim more than is true yet. Our IRS §7216 consent process and Written Information Security Program are built to current IRS guidance (Rev. Proc. 2013-14) and are under review by qualified tax counsel; we don't describe them as finalized or attorney-approved until that review is complete. Separately, for new AIOS builds we deploy inside your own AWS account, not ours, so your clients' taxpayer data never has to leave infrastructure you control.

CAN YOU FILL OUT OUR SECURITY QUESTIONNAIRE?

Yes. Send it to support@fellowshipautomation.com and we'll complete it directly, referencing this page and the detail pages it links to wherever it overlaps.

WHAT AI MODELS DO YOU USE?

We're model-agnostic. Our default is Anthropic (Claude), accessed via Anthropic's API or AWS Bedrock so data can stay in your cloud region, plus OpenAI for specific tasks where it's the best fit. Which models touch your data, and where, is disclosed to you and can be scoped per engagement.