Welcome to Glitter AI's Trust Center. Our commitment to data privacy and security is embedded in every part of our business.
Glitter AI makes business process documentation fast and easy. We help organizations turn every process into a step-by-step guide, streamlining operations and improving efficiency.
At Glitter AI, security and privacy are foundational to everything we do. We implement industry-leading security controls and maintain compliance with rigorous standards to protect our customers' data and ensure business continuity.
For security inquiries or to request additional documentation, please contact our security team at security@glitter.io.
SOC 2 Type II Auditor: GRSee Consulting 
HIPAA BAA available No. Glitter AI never trains models on customer data. Guides are processed by third-party providers (OpenAI, Google Gemini Enterprise Agent Platform) under agreements that exclude the data from training, and the data is not retained by them after processing.
In the United States only. The database, media and backups all live in Google Cloud’s US regions, and nothing is processed or stored outside the US.
Yes. Everything moves over TLS 1.2 or higher and is stored with AES-256 encryption at rest. Keys are managed in Google Cloud KMS and rotated quarterly.
Only you and the people you share them with. Guides are private by default, and sharing is an explicit choice by the guide owner or a team admin. A guide owner can also choose to publish a guide publicly and let search engines index it, but that is a deliberate per-guide decision, never a default. On eligible plans, organization admins can turn public sharing off for the whole organization, which also makes any existing public guides private.
The full list is the subprocessor list on the legal page. For AI, Glitter uses OpenAI, Google (Gemini Enterprise Agent Platform) and ElevenLabs under agreements that exclude customer data from training and delete it within 30 days of processing, most of it right after the guide is generated.
Yes. On eligible plans, the desktop app can blur sensitive information on your device before anything is uploaded. Redaction after the fact is also available, and earlier versions and backup copies of a redacted guide are purged within 30 days.
Use the Request button at the top of this page. The report is confidential and is sent by email, usually within one business day. The auditor is GRSee Consulting.
Yes, under a Business Associate Agreement. Healthcare teams sign a BAA with Glitter (a paid add-on), and once HIPAA is enabled for the organization all AI processing runs on HIPAA-eligible infrastructure under vendor BAAs, public sharing is locked off for the whole organization, and guides stay visible to signed-in members only. Users cannot switch those controls off. Do not record PHI before the BAA is signed. The HIPAA page has the details.
The Data Processing Addendum is published on the legal page and applies to every customer automatically, so there is nothing to sign. It carries the 2021 EU Standard Contractual Clauses, the UK Addendum and the Swiss adjustments for international transfers.
Yes. Glitter acts as your processor under a Data Processing Addendum that contains the Article 28 GDPR terms and applies to every customer. Data is processed in the United States, and transfers from the EEA, the UK and Switzerland are covered by the 2021 EU Standard Contractual Clauses, the UK International Data Transfer Addendum and the Swiss FADP adjustments, all incorporated in the DPA with its annexes. Sub-processors are listed publicly with advance notice of changes, customer content is never used for AI training, and a breach affecting your data is notified within 72 hours.
Yes. The product supports SAML and OAuth single sign-on, and Glitter’s own internal systems run on Google Workspace SSO. On eligible plans, admins can connect their identity provider, enforce SSO so members can only sign in through it, and set the session length for the whole organization, from 1 day up to 90 days.
You stay in control of it. You can delete guides, recordings and other content in the product at any time, during the subscription or when it ends, and deletion is permanent: every remaining copy, including backups, is removed within 30 days. When the subscription ends you can also ask Glitter to return your content in a machine-readable format before it is deleted. Glitter certifies deletion in writing on request, and only keeps what applicable law requires it to retain, isolated from further processing. The exact terms are in section 9 of the Data Processing Addendum.
Automated vulnerability scans run weekly across application dependencies and cloud infrastructure, with dynamic application security testing over production, and an independent SOC 2 Type II audit covers the controls every year. Findings are fixed on defined SLAs: critical within 24 hours, high within 7 days.
The availability objective is 99.9%, with a 4-hour recovery time objective and a 24-hour recovery point objective. Live status and incident history are at status.glitter.io.
Email security@glitter.io. Glitter welcomes responsible disclosure and will work with you to address any legitimate issue promptly.