AI governance

For AI governance boards

Responsible AI governance is part of how Aigora designs products and delivers client work. Security, data protection, and human accountability are design constraints, not afterthoughts.

Aigora provides AI tools for consumer insights and sensory science. Our systems support research exploration and synthesis under human review. They are multi-tenant, with organization-level isolation.

Aigora is in final preparation for its independent SOC 2 Type II examination.

Theus (theus.aigora.ai) inference uses the Google Gemini API under its paid-service terms. Google receives prompts and responses for inference. Client data is not used to train foundation models. Under those terms, Google does not use prompts or responses to improve its products, and keeps them for 55 days only to detect abuse, enforce its usage rules, and meet legal requirements. That Google-side processing is separate from Aigora storage: unsaved work is ephemeral for 24 hours, and durable storage requires organization-admin opt-in.

Enterprise deployments use a separate MSA. Website Terms apply to the public site only.

AI outputs can still be incomplete or wrong. Citations and review tools help people inspect sources; they do not eliminate error. We recommend a bounded pilot with a separate production gate.

What we claim

SOC 2 posture

Aigora is in final preparation for its independent SOC 2 Type II examination.

Training boundary

Client data is not used to train foundation models.

Model inference

Theus (theus.aigora.ai) inference uses the Google Gemini API under its paid-service terms. Google receives prompts and responses for inference.

Google-side processing

Under those terms, Google does not use prompts or responses to improve its products, and keeps them for 55 days only to detect abuse, enforce its usage rules, and meet legal requirements. That Google-side processing is separate from Aigora storage: unsaved work is ephemeral for 24 hours, and durable storage requires organization-admin opt-in.

Tenancy

Multi-tenant products with organization-level isolation.

Retention default

Default ephemeral workspaces use a 24-hour cache unless durable storage is explicitly enabled.

Authentication

Theus sign-in through Google or Microsoft (OAuth), passkeys, email codes, or passwords; OAuth-only is an option.

Encryption

Encryption in transit; encryption at rest for data stored by infrastructure providers.

Human oversight

Material research conclusions require human review. Systems support exploration and synthesis; they do not replace validated research decisions.

Residual risk

AI outputs can be incomplete or wrong. Citations and review tools help people inspect sources; they do not eliminate error.

Contracting

Enterprise deployments use a separate MSA. Website Terms apply to the public site only.

What we do not claim

• Finished independent Type II status for Aigora or Theus
• Error-free AI output, or residual model error as absent
• Automatic correctness of every generated statement solely because a citation exists
• Public identification of companies that use Theus
• That Google cannot access prompts or responses used for inference
• Always-zero Google-side retention of prompts and responses unless Zero Data Retention is contracted

Intended use

• Explore and synthesize institutional research with source references for human inspection
• Support research design and prioritization, including synthetic methods that guide fieldwork rather than replace it
• Assist analysts with drafting, analysis, and training workflows under human accountability

Not intended use

• Fully automated business decisions without human approval
• Sole basis for regulated or safety-critical claims without independent validation
• Training foundation models on customer data

Security and privacy summary

Security and data protection are design constraints. Platform controls include organization isolation. Theus sign-in through Google or Microsoft (OAuth), passkeys, email codes, or passwords; OAuth-only is an option. Encryption in transit; encryption at rest for data stored by infrastructure providers. GDPR and CCPA data-rights review available during procurement. Theus (theus.aigora.ai) inference uses the Google Gemini API under its paid-service terms. Google receives prompts and responses for inference. Under those terms, Google does not use prompts or responses to improve its products, and keeps them for 55 days only to detect abuse, enforce its usage rules, and meet legal requirements. That Google-side processing is separate from Aigora storage: unsaved work is ephemeral for 24 hours, and durable storage requires organization-admin opt-in. Enterprise deployments use a separate MSA. Website Terms apply to the public site only.

Public marketing deployments currently inherit infrastructure controls from providers such as Vercel and Neon. Theus uses the Google Gemini API, under its paid-service terms, for inference; Google receives prompts and responses. Additional services may be used for authentication, storage, and monitoring. The versioned Theus subprocessor register, including purpose and data classes, is provided under NDA during enterprise review.

Products in scope

• Theus. Knowledge exploration with source-linked research work. Product control detail lives in the Theus Trust Center annex. Product page · Theus Trust Center
• Forethought. Synthetic research support for fieldwork design and prioritization, with human review of outputs. Product page
• AI Toolkit and training. Assistive tools and capability transfer for insights teams. Product page
• Custom Decision Systems. Contracted scope defined per engagement. Product page

Evidence availability

Recommended engagement model

1. Bounded pilot on approved data with a named business sponsor
2. Named user cohort, with human review required for material conclusions
3. No autonomous external actions or write-back to systems of record during pilot unless explicitly agreed
4. Success metrics agreed up front (quality, time, adoption, risk events)
5. Separate production gate after pilot evidence

Request deeper diligence

The public company packet is available as a PDF. For the architecture overview, full subprocessor detail, and other NDA materials, use the contact form or reply to your Aigora contact and include security and privacy recipients if needed.

Aigora Governance Packet · Contact for deeper diligence under NDA · Privacy policy · Terms of service · Machine-readable trust manifest

Residual model risk remains. Material conclusions require human review.

Document control

• Version: 2026-10-25
• Last reviewed: 2026-10-25
• Next review: When SOC 2 examination status changes, or within 90 days
• Public company summary. Detailed evidence available under NDA.