Theus trust center

Security and compliance

Executive summary

Aigora is in final preparation for its independent SOC 2 Type II examination. Current deployments inherit controls from Vercel and Neon. Default workspaces are ephemeral (24-hour cache) unless durable storage is enabled by an organization admin. Theus security measures include TLS 1.2 and 1.3 encryption in transit, multi-factor authentication through your identity provider, and automated data expiration, with layered mitigations for OWASP LLM01 (prompt injection), LLM02 (insecure output) and LLM06 (sensitive information disclosure), including PII detection, aligned with NIST AI RMF guidelines.

1. Data encryption and protection

Encryption standards

• In transit: All data transmissions use TLS 1.2 or 1.3
• At rest: Encryption at rest for data stored by infrastructure providers

Data minimization and retention

• Session data: Unsaved session data is automatically and permanently deleted after 24 hours
• Session snapshots: Disabled by default unless enabled by an organization admin. Users may explicitly save session context to a persistent session snapshot; session snapshots are retained for a configurable period (default 30 days, maximum 90 days), can be deleted by the user at any time, and are automatically deleted when expired.
• No training data: Client data is not used to train foundation models.
• Minimal collection: We only collect data necessary for service delivery

2. Identity and access management

Authentication

• Sign-in: Theus sign-in through Google or Microsoft (OAuth), passkeys, email codes, or passwords; OAuth-only is an option.
• Multi-factor authentication: With Google or Microsoft sign-in, your organization's own multi-factor rules apply
• Session management: Short-lived access tokens with secure refresh mechanisms

Access control

• Organization-based isolation: Strict data segregation between organizations
• Principle of least privilege: Users only access data within their organization
• Administrative controls: Separate admin accounts with enhanced security requirements

3. Infrastructure security

Platform security

• Infrastructure: Inherited controls from Vercel and Neon
• Web application firewall: Active protection against OWASP Top 10 threats
• DDoS protection: Global edge network with automatic mitigation
• Rate limiting: Protection against automated attacks and API abuse

Network security

• Zero trust architecture: No implicit trust for any request
• Content Security Policy: Security headers configured to protect against XSS attacks
• HSTS preloading: Enforced HTTPS for all connections

4. Monitoring and incident response

Security monitoring

• Comprehensive audit logging: All authentication and data access events logged
• Real-time threat detection: Automated alerts for suspicious activities
• Security analytics: Pattern analysis to identify potential threats

Incident response

• Incident response: Named owners and a written incident response plan. Alerts are reviewed and response targets met in business hours.
• NIST-based IR plan: Formal incident response procedures
• Breach and incident notification: Affected customers are notified within 24 business hours of discovering a confirmed breach or incident affecting their data.

5. AI and data security

Theus implements comprehensive AI safety through multiple independent layers, ensuring responsible and secure AI interactions at every step.

Model provider

Theus (theus.aigora.ai) inference uses the Google Gemini API under its paid-service terms. Google receives prompts and responses for inference. Under those terms, Google does not use prompts or responses to improve its products, and keeps them for 55 days only to detect abuse, enforce its usage rules, and meet legal requirements. That Google-side processing is separate from Aigora storage: unsaved work is ephemeral for 24 hours, and durable storage requires organization-admin opt-in.

On Google's side, authorized staff may review flagged content, and monitoring data may be used for policy enforcement models. Stored files, caches, and optional features have separate retention rules. Theus does not promise Zero Data Retention from Google.

The in-app helper keeps its recent conversation, including voice transcripts, in the user's own browser, and clears it when the helper next loads after 24 hours without use.

Provider sources: Gemini API Paid Services terms and Google abuse monitoring policy.

Five-layer safety architecture

• Layer 1: Input validation and sanitization (OWASP LLM01)
  • Prompt injection defense: 10 regex patterns filter known attack vectors including LLM instruction tags ([INST], <<SYS>>), ChatML format, and instruction override phrases
  • Sanitize-before-truncate: Patterns filtered before length truncation to prevent bypass attacks
  • Length limits: 10,000 character maximum with resource exhaustion prevention
  • Rate limiting: Per-user and per-organization limits (e.g., 10 requests/minute for Expert)
• Layer 2: Prompt engineering controls
  • Structured prompt templates with safety instructions
  • Role-based boundaries for AI behavior
  • Context isolation between sessions
  • Injection attack prevention patterns
• Layer 3: Model-level safety (Google Gemini)
  • Built-in content filters for harmful content
  • Bias mitigation in model training
  • Continuous safety updates from Google
• Layer 4: Output validation and PII protection (OWASP LLM06)
  • Real-time PII detection: Automatic detection of emails, phone numbers, SSNs, and credit card numbers in what users type into the research and simulation chats (not the in-app helper)
  • User-controlled redaction: When PII is detected, users receive a confirmation dialog with options to cancel, redact (replace with [REDACTED]), or send as-is
  • Content safety filters: Google Gemini built-in safety thresholds block harmful content generation
  • Schema validation: Zod-based validation ensures AI outputs conform to expected formats
• Layer 5: Human oversight and control
  • Required human moderation for all sessions
  • Real-time intervention capabilities
  • Session termination controls
  • Comprehensive audit logging

Data protection

• Client data is not used to train foundation models.
• 24-hour automatic deletion
• Complete session isolation
• Default posture is session-only: no user-owned data persists on Aigora's servers beyond 24 hours unless an organization admin explicitly opts in to organization data storage via /admin/settings → Data Retention. Users can download current-session files while storage is off; saved panelists, saved knowledge artifacts, media uploads, parser outputs, saved report bundles, and session snapshots are blocked at the API level until that opt-in is made.

Continuous monitoring

• Real-time anomaly detection
• Usage pattern analysis
• Automated threat response
• Security event logging

6. Compliance status

Privacy and infrastructure

• GDPR and CCPA: GDPR and CCPA data-rights review available during procurement.
• Infrastructure: Inherited controls from Vercel and Neon

Audit status

• SOC 2: Aigora is in final preparation for its independent SOC 2 Type II examination.
• ISO 27001: On the roadmap (not yet certified)

7. Security best practices

• Secure development: Security review for all code changes
• Dependency management: Automated vulnerability scanning
• Penetration testing: As of October 2026, an independent penetration test of Theus has been purchased and is scheduled after the current release. A summary will be available on request once it is complete.
• Security training: Ongoing security awareness for all staff

8. Third-party security

We carefully vet all third-party services, including:

• Vercel: Infrastructure and hosting (SOC 2 Type II)
• Clerk: Authentication services (SOC 2 Type II)
• Google Cloud: AI services (ISO 27001, SOC 2)
• Neon: Postgres database, through Vercel Postgres (SOC 2 Type II)
• Upstash: Key-value cache, through Vercel KV (SOC 2 Type II)

9. IT configuration

For detailed network configuration requirements, please refer to our comprehensive IT configuration guide below.

Security contact

For security inquiries, vulnerability reports, or to request our detailed security documentation:

Email: help@aigora.com

Privacy policy

Our privacy commitment

Theus is designed for privacy: minimal data collection and automatic deletion. Client data is not used to train foundation models. This policy explains how we protect your information.

1. Information we collect

1.1 Information you provide

• Account information: Name, email, and organization details when you sign up
• Simulation inputs: Product descriptions, goals, and parameters you enter
• Context documents: Optional files you upload for enhanced simulations (automatically deleted after 24 hours)
• Feedback: Any feedback or support requests you submit
• Voice: If you use the in-app helper's voice mode, your speech goes from your browser to Google's Gemini Live API for processing

1.2 Information collected automatically

• Usage data: Features used, simulation parameters, and interaction patterns
• Technical data: Browser type, device information, and IP address
• Performance data: Error logs and performance metrics to improve service quality

1.3 Information we don't collect

• Personal data about simulated panelists (they're AI-generated)
• Unnecessary personal information
• Sensitive categories of personal data

2. How we use your information

2.1 Primary uses

• Service delivery: Running your simulations and generating insights
• Account management: Authentication and access control
• Communication: Service updates and support responses
• Improvement: Enhancing features and user experience

2.2 What we don't do

• Sell your personal information
• Use client data to train foundation models
• Share simulation content with other customers
• Perform behavioral advertising

3. Information sharing

We share your information only in these limited circumstances:

3.1 Service providers

• Infrastructure: Vercel (hosting), Neon (database), Google Cloud (document storage and conversion), Railway (document conversion), Inngest (background jobs), Upstash (cache), and Clerk (authentication); application email through Google Workspace; public product reviews through Apify; user feedback through Aigora's feedback service on Cloudflare Workers, to Slack
• AI processing: Google Cloud (Gemini API). Theus (theus.aigora.ai) inference uses the Google Gemini API under its paid-service terms. Google receives prompts and responses for inference. Under those terms, Google does not use prompts or responses to improve its products, and keeps them for 55 days only to detect abuse, enforce its usage rules, and meet legal requirements. That Google-side processing is separate from Aigora storage: unsaved work is ephemeral for 24 hours, and durable storage requires organization-admin opt-in.
• Analytics: Aggregated usage data only

3.2 Legal requirements

We may disclose information if required by law, subpoena, or to protect rights and safety.

3.3 Business transfers

In case of merger or acquisition, your information may transfer to the new entity.

4. Data security

We implement comprehensive security measures:

• Encryption: Encryption in transit; encryption at rest for data stored by infrastructure providers.
• Access controls: Role-based permissions and authentication
• Infrastructure: Inherited controls from Vercel and Neon
• Incident response: Named owners and a written incident response plan. Alerts are reviewed and response targets met in business hours.
• Security reviews: Quarterly internal reviews of access and network controls. First independent penetration test purchased (October 2026).

5. Data retention and deletion

Automatic deletion policy

• Simulation data: Automatically deleted after 24 hours unless explicitly saved to an enabled session snapshot
• Context documents: Deleted with simulation data
• Session snapshots: Disabled by default; when enabled by the organization and explicitly saved by the user, retained for the configured 30-90 day period
• AI-generated avatars: Deleted after 72 hours
• Account data: Retained while account is active
• Audit logs: Retained for 365 days for security

You can request immediate deletion of your account and associated data at any time.

6. Your rights and choices

6.1 Your rights

• Access: Request a copy of your personal data
• Correction: Update inaccurate information
• Deletion: Request deletion of your data
• Portability: Export your data in standard formats
• Objection: Opt out of certain data uses

6.2 How to exercise rights

Contact us at privacy@aigora.com with your request. We'll respond within 30 days.

7. International data transfers

Theus's servers, database, and file storage are in the United States. Vercel's edge network, Google's AI processing, Cloudflare (for user feedback), and Apify may process data in other countries under their published terms.

• Compliance with US data protection laws

8. AI-specific considerations

Important AI privacy facts

• Theus (theus.aigora.ai) inference uses the Google Gemini API under its paid-service terms. Google receives prompts and responses for inference.
• Under those terms, Google does not use prompts or responses to improve its products, and keeps them for 55 days only to detect abuse, enforce its usage rules, and meet legal requirements. That Google-side processing is separate from Aigora storage: unsaved work is ephemeral for 24 hours, and durable storage requires organization-admin opt-in.
• Simulation data remains isolated between organizations
• On Google's side, authorized staff may review flagged content, and monitoring data may be used for policy enforcement models. Stored files, caches, and optional features have separate retention rules. Theus does not promise Zero Data Retention from Google.

PII protection

• Real-time detection: Automatic detection of personal information (emails, phone numbers, SSNs, credit cards) in what you type into the research and simulation chats, before submission. The in-app helper, typed or voice, doesn't run this check; its voice mode sends speech to Google directly
• User control: When PII is detected, you choose: cancel, redact (replace with [REDACTED]), or send as-is
• No training: Client data is not used to train foundation models. Google processing follows the provider terms above
• Auto-deletion: Unsaved session data including any PII is automatically deleted after 24 hours

9. Cookie policy

We use minimal cookies necessary for service operation:

• Essential cookies: Authentication and security
• Functional cookies: User preferences and settings
• Analytics cookies: Anonymous usage statistics (optional)

We don't use advertising or tracking cookies.

10. Children's privacy

Theus is not intended for users under 18. We don't knowingly collect information from children. If we learn we've collected data from someone under 18, we'll delete it promptly.

11. Updates to this policy

We may update this policy to reflect service changes or legal requirements. We'll notify you of material changes via email or service notifications. Continued use after updates constitutes acceptance.

12. Contact us

For privacy questions or to exercise your rights:

Privacy team

• Email: privacy@aigora.com
• Address: Aigora, LLC, Virginia, USA

For general inquiries, see contact information in other sections.

We aim to respond to all privacy requests within 30 days. For urgent matters, please indicate “URGENT” in your subject line.

Terms of service

These Terms of Service (“Terms”) constitute a legally binding agreement between Aigora (“Aigora,” “we,” “us,” or “our”) and you concerning your use of the Theus AI-powered knowledge exploration platform (“Service”). By accessing or using the Service, you agree to these Terms.

1. Agreement to terms

1.1 Eligibility. You must be at least 18 years old and have the legal capacity to enter into contracts. If you're using the Service on behalf of an organization, you represent that you have authority to bind that organization to these Terms.

1.2 Acceptance. By clicking “I Agree,” accessing, or using the Service, you accept these Terms. If you don't agree, don't use the Service.

1.3 Additional Terms. Your use is also subject to our Privacy Policy, which is incorporated by reference. Additional terms may apply to specific features.

2. Service description

2.1 What We Provide. Theus is an AI-powered platform that creates simulated focus group discussions with AI-generated personas. The Service is designed for qualitative research and idea exploration.

2.2 No Real Participants. All focus group participants in the Service are AI-generated personas. No real individuals participate in your simulations.

2.3 Service Limitations. The Service provides AI-generated insights that should not replace validated market research or be used as the sole basis for business decisions.

3. User accounts

3.1 Account Creation. You must provide accurate, current, and complete information. You're responsible for maintaining the confidentiality of your account credentials.

3.2 Account Security. You're responsible for all activities under your account. Notify us immediately of any unauthorized use.

3.3 Organizations. If you create an organizational account, you may add team members who will be bound by these Terms.

4. Acceptable use

4.1 Permitted Use. You may use the Service only for lawful purposes and in accordance with these Terms.

4.2 Prohibited Uses. You may not:

• Use the Service for any illegal or harmful purpose
• Attempt to reverse engineer or extract the AI models
• Submit content that is offensive, discriminatory, or harmful
• Attempt to bypass usage limits or security measures
• Use the Service to create misleading or deceptive content
• Resell or redistribute the Service without authorization

5. AI-generated content

5.1 Nature of Content. All personas, discussions, and insights are AI-generated. They may contain inaccuracies, biases, or inconsistencies.

5.2 No Warranties. We don't warrant the accuracy, completeness, or reliability of AI-generated content. Use it at your own risk.

5.3 Human Oversight Required. Always apply human judgment and validation to AI-generated insights before making decisions.

6. Intellectual property

6.1 Service IP. Aigora owns all rights in the Service, including software, designs, and AI models.

6.2 Your Content. You retain rights to your input content. By using the Service, you grant us a license to process your content to provide the Service.

6.3 Output Content. Subject to your compliance with these Terms, you may use the AI-generated output for your internal business purposes.

7. Payment terms

7.1 Subscription Fees. Paid features require a subscription. Fees are billed in advance and are non-refundable except as required by law.

7.2 Changes to Pricing. We may change pricing with 30 days' notice. Continued use after price changes constitutes acceptance.

7.3 Taxes. You're responsible for all applicable taxes, which we'll add to your bill where required.

8. Privacy and data protection

8.1 Privacy Policy. Our Privacy Policy describes how we collect, use, and protect your information.

8.2 Data Security. We implement reasonable security measures but cannot guarantee absolute security.

8.3 Data Deletion. Unsaved simulation data is automatically deleted after 24 hours. If your organization enables session snapshots, you may explicitly save or export results before deletion.

8.4 AI Processing. Theus (theus.aigora.ai) inference uses the Google Gemini API under its paid-service terms. Google receives prompts and responses for inference. Under those terms, Google does not use prompts or responses to improve its products, and keeps them for 55 days only to detect abuse, enforce its usage rules, and meet legal requirements. That Google-side processing is separate from Aigora storage: unsaved work is ephemeral for 24 hours, and durable storage requires organization-admin opt-in. On Google's side, authorized staff may review flagged content, and monitoring data may be used for policy enforcement models. Stored files, caches, and optional features have separate retention rules. Theus does not promise Zero Data Retention from Google.

9. Disclaimers and limitations

9.1 AS-IS Service. THE SERVICE IS PROVIDED “AS IS” WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED.

9.2 Limitation of Liability. TO THE MAXIMUM EXTENT PERMITTED BY LAW, AIGORA WON'T BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES.

9.3 Total Liability Cap. Our total liability won't exceed the fees you paid us in the 12 months before the claim.

10. Indemnification

You'll indemnify and hold harmless Aigora from any claims arising from your use of the Service, violation of these Terms, or infringement of any rights.

11. Termination

11.1 Your Right to Terminate. You may stop using the Service and close your account at any time.

11.2 Our Right to Terminate. We may suspend or terminate your access for violation of these Terms or at our discretion with notice.

11.3 Effect of Termination. Upon termination, your right to use the Service ceases immediately. Provisions that should survive will remain in effect.

12. General provisions

12.1 Governing Law. These Terms are governed by Delaware law, excluding conflict of laws principles.

12.2 Dispute Resolution. Disputes will be resolved through binding arbitration in Delaware, except where prohibited.

12.3 Changes to Terms. We may update these Terms. Continued use after changes constitutes acceptance.

12.4 Entire Agreement. These Terms and referenced policies constitute the entire agreement between us.

13. Contact information

For questions about these Terms or the Service, contact us at:

Aigora

• Email: help@aigora.com
• Website: https://aigora.ai

IT configuration guide

Executive summary

This guide provides IT administrators with the necessary information to configure firewalls, proxies, and security policies for enterprise environments.

1. Quick start guide

For standard corporate networks, configure the following:

1. Whitelist domains: *.aigora.ai and *.clerk.services
2. Add identity provider: accounts.google.com or login.microsoftonline.com
3. Allow HTTPS (port 443): With WebSocket support enabled
4. Test access: Visit https://theus.aigora.ai

2. Domain requirements

Core application domains (required)

• *.aigora.ai: Main application, APIs, and private avatar proxy endpoints
• *.clerk.services: Authentication UI components and session management

Identity provider domains

Add domains for your organization's identity provider:

• Google Workspace
  • accounts.google.com
• Microsoft 365
  • login.microsoftonline.com
  • login.microsoft.com

Optional domains

These enhance the experience but are not required:

• fonts.googleapis.com: Web fonts (graceful fallback if blocked)
• fonts.gstatic.com: Font files (graceful fallback if blocked)
• feedback.aigora.systems: User feedback submission
• generativelanguage.googleapis.com: In-app helper voice mode (WebSocket on port 443); Theus's other Gemini AI processing runs on its servers
• vitals.vercel-insights.com: Web analytics
• *.clerk.dev: Fallback authentication assets

3. Network requirements

• Port 443: Standard HTTPS port
• WebSocket over HTTPS: Required for real-time authentication (uses same port 443)
• Server-Sent Events (SSE): For session streaming

4. SSL/TLS inspection

• Certificate pinning: Not used. SSL inspection is compatible
• Recommended exceptions: Consider adding SSL inspection exceptions for *.clerk.services and *.aigora.ai if experiencing issues

5. Server-side services (no whitelisting needed)

For transparency, these services are used by our backend infrastructure. Your IT team may see these in server logs, but they do not require whitelisting as they are never accessed from user browsers:

• *.upstash.io: Key-value cache (Vercel KV, run by Upstash)
• *.postgres.vercel-storage.com: Postgres database (Vercel Postgres, run by Neon)
• *.blob.vercel-storage.com: Server-side Blob storage for private tenant artifacts and public site assets
• storage.googleapis.com: Default avatar images
• placehold.co: Fallback placeholder avatars
• *.vercel.app: Infrastructure (using custom domain instead)
• hooks.slack.com: Optional Slack notifications (if configured)

6. Enterprise proxy configuration

WebSocket requirements

• HTTP CONNECT method must be allowed for *.clerk.services
• Upgrade headers must not be stripped
• Long-lived connections must be permitted (30+ seconds)

Server-Sent Events (SSE)

• Proxy timeout should be >60 seconds
• Response buffering should be disabled for /api/simulation/stream
• Content-Type text/event-stream must be allowed

7. Additional resources

For comprehensive security details and data handling practices, please refer to:

• Security and compliance section: Detailed security measures and data retention policies
• Privacy policy: Complete data handling and privacy practices
• GenAI committee guide: AI governance documentation and compliance details

Technical support

For technical support or questions about network configuration:

Email: help@aigora.com

Include “IT Configuration” in the subject line and any error messages or blocked domain logs.

GenAI committee approval guide

What Theus is

Purpose: Theus organizes a team's research into a cited Research Base and supports exploratory research through moderated discussions with AI-generated panelists.

What it does

• Supports idea screening and hypothesis generation
• Provides AI-generated panelists grounded in your Research Base
• Offers private Whisper guidance for moderators
• Generates instant reports with clear methodology notes

What it doesn't do

• Does not train foundation models on client data
• Does not make automated decisions
• Does not replace validated research
• Does not share data across organizations

• Data boundary: Public knowledge enriches discussions. Private evidence remains isolated.
• Security: Aigora is in final preparation for its independent SOC 2 Type II examination. ISO 27001 (roadmap). GDPR and CCPA data-rights review available during procurement.
• Enterprise ready: SSO (Google and Microsoft), RBAC, audit logs, data isolation

Architecture and data flow

1. User input → Input validation and safety
2. Mode selection
   • Global Knowledge → Public context only
   • Blended → Public + private context
   • Private Only → Private context only
3. Google Gemini API → Content safety filtering
4. Unsaved session data (24hr retention) → Report generation
5. Explicit session snapshot (org-admin opt-in, 30-90 day retention)

Avatars and audit logs

• Avatar generation → Nano Banana 2 Lite → Avatar storage (72hr)
• Audit logs → 365 day retention

Multiple safety layers

Layer 1: Input validation → Layer 2: Prompt engineering → Layer 3: AI safety filters → Layer 4: Output validation → Layer 5: Human review, with continuous monitoring across every layer.

Safety implementation

1. Input layer: 10 regex patterns block prompt injection attacks ([INST], ChatML, override phrases); sanitize-before-truncate prevents bypass; PII detection with user redaction option in the research and simulation chats
2. Prompt layer: Structured prompts with safety instructions, role-based boundaries
3. Model layer: Google Gemini API safety filters with configurable thresholds
4. Output layer: Zod schema validation, content safety checks, format validation
5. Human layer: Required moderation for all sessions, real-time intervention

Data privacy and security

Core principles

• No training: Client data is not used to train foundation models.
• Model inference: Theus (theus.aigora.ai) inference uses the Google Gemini API under its paid-service terms. Google receives prompts and responses for inference. Under those terms, Google does not use prompts or responses to improve its products, and keeps them for 55 days only to detect abuse, enforce its usage rules, and meet legal requirements. That Google-side processing is separate from Aigora storage: unsaved work is ephemeral for 24 hours, and durable storage requires organization-admin opt-in. Theus does not promise Zero Data Retention from Google.
• Data minimization: Only essential data collected
• Isolation: Strict tenant separation
• Encryption: Encryption in transit; encryption at rest for data stored by infrastructure providers.
• Retention: 24-hour unsaved sessions (default), 72-hour session avatars, session snapshots disabled by default and configurable per organization for 30-90 days with automatic expiration

Sub-processors

Data governance framework

Data collection and processing

• Minimal data collection principle
• Purpose limitation enforcement
• Explicit consent requirements
• Data accuracy maintenance
• Cross-border transfer controls

Data rights and controls

• Right to access (data portability)
• Right to rectification
• Right to erasure (24hr auto-delete)
• Right to restrict processing
• Right to object

Data flow transparency

1. Input stage: User prompts → PII detection in the research and simulation chats (with redaction option) → Prompt injection filtering → Input validation → Prompt construction
2. Processing stage: Google Gemini (Gemini API) receives prompts and responses for inference → not used to improve Google's products under its paid-service terms; abuse monitoring retention for 55 days; no promise of Zero Data Retention → Response generation
3. Storage stage: Session data (24hr TTL) → Session snapshots (org-admin opt-in, 30-90 day TTL) → Avatar images (72hr TTL) → Audit logs (365 days)
4. Deletion stage: Automated cleanup → Cryptographic erasure → Verification logging

Zero trust data architecture

Every data access request is verified with:

• Identity verification (OAuth 2.0)
• Session validation
• Organization boundary enforcement
• Access logging and monitoring
• Anomaly detection

Responsible AI framework

Governance alignment

• NIST AI RMF (Govern, Map, Measure, Manage)

Risk register and mitigations (OWASP LLM Top 10)

Clear disclaimers and limitations

Important limitations

• Theus is an exploratory tool, not a decision-making system
• AI-generated content may contain inaccuracies
• Results require validation through traditional research
• Aigora is not liable for AI model outputs or hallucinations
• Not intended for regulated research requiring IRB approval

Customer controls

Configurable settings

• Mode selection (Global/Blended/Private)
• Data retention periods
• Session snapshot retention periods (30-90 days)
• Session snapshot feature enable/disable (per organization, disabled by default)
• User access controls
• Export permissions
• API access
• Audit log retention

Fast-track approval checklist

GenAI committee quick approval checklist

• Client data not used to train foundation models
• Clear data retention and deletion
• Sub-processors documented
• Security roadmap published
• AI governance framework
• Architecture documented
• Customer controls available
• Incident response plan
• Human oversight required

Additional trust center resources

• Security and compliance: Security controls, audit status and data handling
• Privacy policy: How we protect and handle your data
• Terms of service: Clear terms for using Theus
• IT configuration: Network setup and domain requirements

Contact information

For all GenAI Committee inquiries: help@aigora.com

Please include “GenAI Committee” in the subject line for priority routing to our security and compliance team.

Contact

Security, IT configuration and GenAI committee questions: help@aigora.com.

Privacy questions and data-rights requests: privacy@aigora.com.