Security & compliance at Bluejay
Bluejay is the QA platform for voice and chat AI agents. Customers route production conversations through us, so how we hold that data matters. This page states our certifications and security commitments in full. Report copies and signed agreements are available through our compliance portal.
Certifications
SOC 2 Type II
Independently audited against the AICPA SOC 2 Trust Services Criteria. The full report is available under NDA through the compliance portal.
HIPAA
Bluejay is HIPAA compliant and signs Business Associate Agreements.
GDPR
A GDPR compliance review is complete and available through the compliance portal, along with a Data Processing Agreement.
Request the SOC 2 Type II report, the GDPR compliance review and a signed BAA or DPA through the compliance portal.
How we protect your data
Encrypted in transit and at rest
We encrypt your data in transit with TLS 1.2+ and at rest with AES-256.
Encrypted daily backups
We back up production databases daily, keep those backups encrypted, and test restoration each year.
SSO and MFA
We manage access through single sign-on with Okta or Google Workspace, and enforce MFA wherever SSO isn’t available.
Least privilege, reviewed quarterly
We grant the minimum access each role needs and review access rights every quarter.
Every change is reviewed
Every code change goes through a peer-reviewed pull request, and our main branch is protected from force pushes.
Pen-tested every year
An external firm penetration tests our production environment at least once a year.
We monitor production
We keep production logs for 30 days and alert our engineering team to outages and suspicious activity.
A defined incident escalation path
We investigate security incidents on a defined escalation path and notify affected customers within 24 hours.
Your data never trains AI models
Your data is never used to train or fine-tune AI models, and our AI providers are configured for zero data retention.
Policies
Fifteen policies are maintained and available on request:
- Access control policy
- AI policy
- Asset management policy
- Breach notification policy
- Business continuity, backup and recovery policy
- Code of conduct policy
- Cookie and tracking technologies policy
- Data management policy
- Human resource security policy
- Information security policy
- Operations security policy
- Privacy policy
- Risk management policy
- Secure development policy
- Third-party policy
Subprocessors
We publish our full subprocessor list — 36 providers across cloud hosting, analytics, monitoring, data storage and AI inference, each with its processing region. View the current list.
Frequently asked questions
Is Bluejay SOC 2 compliant?
Yes. Bluejay is SOC 2 Type II, independently audited against the AICPA SOC 2 Trust Services Criteria. The full report is available under NDA through our compliance portal.
Is Bluejay HIPAA compliant, and will you sign a BAA?
Yes. Bluejay is HIPAA compliant and signs Business Associate Agreements. Request one through the compliance portal.
Do you use our data to train AI models?
No. Your data is never used to train or fine-tune AI models, and our AI providers are configured for zero data retention.
How is our data encrypted?
In transit with TLS 1.2+ and at rest with AES-256.
Are you GDPR compliant?
A GDPR compliance review is complete and available through the compliance portal, along with a Data Processing Agreement.
Who are your subprocessors?
We publish all 36, each with its processing region, covering cloud hosting, analytics, monitoring, data storage and AI inference. The current list is on the compliance portal.
Do you penetration test?
Yes. An external firm penetration tests our production environment at least once a year.
How do you handle a security incident?
We investigate on a defined escalation path and notify affected customers within 24 hours.
How do I report a security vulnerability?
Email [email protected] with the subject line SECURITY, or submit a report through our compliance portal. We acknowledge reports and will keep you updated through to resolution.
How do we request your security documentation?
The SOC 2 Type II report, GDPR compliance review, signed BAA or DPA, and any of our fifteen policies are available on request through the compliance portal.
Contact
Report a vulnerability. Email [email protected] with the subject line SECURITY, or file a report through the compliance portal. We acknowledge reports and keep you updated through to resolution.
Security questions and document requests. The SOC 2 Type II report, GDPR compliance review, signed BAA or DPA and any of our fifteen policies are available through the compliance portal.
Bluejay Intelligence, Inc., 210 Azalea Ln, San Ramon, CA 94582, USA.