Welcome to Glitter AI's Trust Center. Our commitment to data privacy and security is embedded in every part of our business.
Glitter AI makes business process documentation fast and easy. We help organizations turn every process into a step-by-step guide, streamlining operations and improving efficiency.
At Glitter AI, security and privacy are foundational to everything we do. We implement industry-leading security controls and maintain compliance with rigorous standards to protect our customers' data and ensure business continuity.
For security inquiries or to request additional documentation, please contact our security team at security@glitter.io.
SOC 2 Type II Auditor: GRSee Consulting 
HIPAA BAA available Glitter AI logs and monitors all access attempts to company resources through Google Cloud Audit Logs and integrated monitoring tools. Access logs are retained for one year and reviewed quarterly by the Security Officer. Automated alerting is configured for suspicious access patterns and violations.
Glitter AI maintains certificates of destruction for all end-of-life devices and media containing sensitive data. Physical media disposal follows NIST SP 800-88 standards with secure wiping and professional destruction services. All destruction activities are documented and certificates retained for audit purposes.
Glitter AI maintains a four-tier data classification scheme: Public, Internal, Confidential, and Restricted. All data assets are labeled with appropriate classification metadata to enforce proper access controls and encryption requirements. Automated scans verify classification integrity and alert on misclassified items.
Glitter AI implements automated daily backups for all production databases and critical data. Backups are stored encrypted in multi-region Google Cloud Storage and retained for 30 days. Database backups are tested quarterly to ensure recovery capability. All backup processes are monitored with automated alerting for failures.
Glitter AI implements secure data erasure using NIST SP 800-88 standards for all end-of-life devices and media. Electronic media undergoes cryptographic erasure and overwriting, while physical media is destroyed through professional shredding services. All erasure activities are documented and certificates retained for audit purposes.
All Glitter AI production databases and storage systems use AES-256 encryption at rest. Database disks and Cloud Storage buckets on Google Cloud are encrypted by default, and application keys are managed in Cloud KMS. Key rotation occurs quarterly.
All Glitter AI data transmissions use TLS 1.2 or higher encryption. HTTPS is enforced across all applications and APIs. Database connections and inter-service communications use encrypted connections.
Glitter AI customer data is stored in US regions only. The database, media and backups all live in Google Cloud’s US regions. Data residency requirements are enforced through infrastructure configuration and no customer data is processed or stored outside the United States.
Glitter AI implements multiple layers of information disclosure protection including on-device and cloud-based data redaction features, encryption at rest and in transit, access controls with role-based permissions, and comprehensive logging. Customer data is protected through privacy-by-design principles and automated redaction capabilities that prevent sensitive information exposure.
Glitter AI follows documented retention schedules for all media and data types. Customers can delete their content at any time, and deleted content, including prior versions of redacted screenshots, is removed from all systems and backups within 30 days. After a subscription ends, content is returned or deleted at the customer’s request. System logs are retained for 90 days in Cloud Logging and 1 year in archive storage. Database backups are retained for 30 days. All retention periods align with legal requirements and are enforced through automated lifecycle policies.
Glitter AI protects physical and digital media through encryption, access controls, and secure handling procedures. Company-provided laptops use full-disk encryption and are secured in home office environments. Digital media is encrypted at rest and in transit. Physical media disposal follows NIST standards with secure wiping and professional destruction services.
Glitter AI follows NIST SP 800-88 standards for physical media disposal. End-of-life company-provided laptops undergo secure wiping with multiple overwrite passes or cryptographic erasure. Physical destruction is performed by certified vendors for devices that cannot be securely wiped. All disposal activities are documented with certificates retained for compliance auditing.
Glitter AI operates as a fully remote company with physical security controls focused on home office environments and cloud infrastructure. Company-provided laptops require full-disk encryption and secure storage when unattended. Cloud infrastructure security is managed by Google Cloud and Vercel with SOC 2 compliance verified annually. Physical access to data centers is controlled by cloud providers and monitored through compliance attestations.
Glitter AI manages secrets and cryptographic keys using Google Cloud KMS for encryption key management with quarterly rotation. Application secrets are stored in Secret Manager and the hosting platform’s encrypted environment variables. Access to secrets is controlled through IAM policies with least privilege principles, and rotation is monitored through automated alerts.
Glitter AI implements comprehensive sensitive data management through data classification, encryption, access controls, and redaction capabilities. Customer PII is classified according to a four-tier scheme and protected with AES-256 encryption. On-device and cloud-based redaction features prevent sensitive data exposure. Access is restricted through role-based permissions and all handling is logged for audit purposes.