Question 1

Do you train any AI models on customer data?

Accepted Answer

No. Glitter AI never trains models on customer data. Guides are processed by third-party providers (OpenAI, Google Gemini Enterprise Agent Platform) under agreements that exclude the data from training, and the data is not retained by them after processing.

Question 2

Where is my data stored?

Accepted Answer

In the United States only. The database, media and backups all live in Google Cloud's US regions, and nothing is processed or stored outside the US.

Question 3

Is my data encrypted?

Accepted Answer

Yes. Everything moves over TLS 1.2 or higher and is stored with AES-256 encryption at rest. Keys are managed in Google Cloud KMS and rotated quarterly.

Question 4

Who can see my guides?

Accepted Answer

Only you and the people you share them with. Guides are private by default, and sharing is an explicit choice by the guide owner or a team admin. A guide owner can also choose to publish a guide publicly and let search engines index it, but that is a deliberate per-guide decision, never a default. On eligible plans, organization admins can turn public sharing off for the whole organization, which also makes any existing public guides private.

Question 5

Which third parties process my data?

Accepted Answer

The full list is the subprocessor list on the legal page. For AI, Glitter uses OpenAI, Google (Gemini Enterprise Agent Platform) and ElevenLabs under agreements that exclude customer data from training and delete it within 30 days of processing, most of it right after the guide is generated.

Question 6

Can I keep sensitive information from leaving my computer?

Accepted Answer

Yes. On eligible plans, the desktop app can blur sensitive information on your device before anything is uploaded. Redaction after the fact is also available, and earlier versions and backup copies of a redacted guide are purged within 30 days.

Question 7

How do I get the SOC 2 report?

Accepted Answer

Use the Request button at the top of this page. The report is confidential and is sent by email, usually within one business day. The auditor is GRSee Consulting.

Question 8

Are you HIPAA compliant?

Accepted Answer

Yes, under a Business Associate Agreement. Healthcare teams sign a BAA with Glitter (a paid add-on), and once HIPAA is enabled for the organization all AI processing runs on HIPAA-eligible infrastructure under vendor BAAs, public sharing is locked off for the whole organization, and guides stay visible to signed-in members only. Users cannot switch those controls off. Do not record PHI before the BAA is signed. The HIPAA page has the details.

Question 9

Do you sign a DPA?

Accepted Answer

The Data Processing Addendum is published on the legal page and applies to every customer automatically, so there is nothing to sign. It carries the 2021 EU Standard Contractual Clauses, the UK Addendum and the Swiss adjustments for international transfers.

Question 10

Are you GDPR compliant? How are EU transfers covered?

Accepted Answer

Yes. Glitter acts as your processor under a Data Processing Addendum that contains the Article 28 GDPR terms and applies to every customer. Data is processed in the United States, and transfers from the EEA, the UK and Switzerland are covered by the 2021 EU Standard Contractual Clauses, the UK International Data Transfer Addendum and the Swiss FADP adjustments, all incorporated in the DPA with its annexes. Sub-processors are listed publicly with advance notice of changes, customer content is never used for AI training, and a breach affecting your data is notified within 72 hours.

Question 11

Do you support SSO?

Accepted Answer

Yes. The product supports SAML and OAuth single sign-on, and Glitter's own internal systems run on Google Workspace SSO. On eligible plans, admins can connect their identity provider, enforce SSO so members can only sign in through it, and set the session length for the whole organization, from 1 day up to 90 days.

Question 12

What happens to my data when I cancel?

Accepted Answer

You stay in control of it. You can delete guides, recordings and other content in the product at any time, during the subscription or when it ends, and deletion is permanent: every remaining copy, including backups, is removed within 30 days. When the subscription ends you can also ask Glitter to return your content in a machine-readable format before it is deleted. Glitter certifies deletion in writing on request, and only keeps what applicable law requires it to retain, isolated from further processing. The exact terms are in section 9 of the Data Processing Addendum.

Question 13

What security testing do you do?

Accepted Answer

Automated vulnerability scans run weekly across application dependencies and cloud infrastructure, with dynamic application security testing over production, and an independent SOC 2 Type II audit covers the controls every year. Findings are fixed on defined SLAs: critical within 24 hours, high within 7 days.

Question 14

What are your uptime and recovery objectives?

Accepted Answer

The availability objective is 99.9%, with a 4-hour recovery time objective and a 24-hour recovery point objective. Live status and incident history are at status.glitter.io.

Question 15

How do I report a security issue?

Accepted Answer

Email security@glitter.io. Glitter welcomes responsible disclosure and will work with you to address any legitimate issue promptly.

Trust Center

Overview

About Glitter AI

Our Security Commitment

What You'll Find Here

Compliance

Reports and documents

Product security

Data security

Application security

AI

Risk profile

Governance and ethics

Legal

Infrastructure

Security practices

Frequently asked

Data access level

Impact level

Recovery time objective

Recovery point objective

Critical dependence

Third party dependence

Hosting