Built to protect sensitive information.
Families and firms trust Anchor Core AI with financial details, health questions, and personal data. That trust is the product. Here's exactly how that information is kept safe — in plain language, with no overstated claims.
“Except the LORD keep the city, the watchman waketh but in vain.” — Psalm 127:1 · We build the walls, and we keep the watch — and we know Who keeps us.
Security built in at every layer.
Not a checkbox bolted on at the end — encryption, isolation, and access control are part of how the platform is built.
The security layers
Encrypted end to end
Every connection is protected with TLS/HTTPS in transit, and all data is encrypted at rest (AES-256) on the database. Nothing sensitive is ever stored or sent in the clear.
Strict per-account isolation
Each account's data is partitioned and protected by row-level security in the database. One account can never see another's clients, cases, or financials — it's enforced at the data layer, not just the screen.
Access control at the server
Owner, admin, sub-admin, agent, and assistant each see only what their role allows — and it's enforced on the server, not just hidden in the UI. The financial and configuration back office is blocked at the edge for restricted roles.
Two-factor by default
Administrator accounts require multi-factor authentication (MFA) out of the box, and every password meets a strong complexity standard. Sessions end automatically after inactivity so an unattended screen can't be misused.
Least privilege by design
Read-only investigation seats, an assistant role with no access to financials or configuration, and credentials that are scoped to exactly what each person needs — nothing more.
Always-on monitoring
A nightly self-healing audit and an on-demand deep-dive sweep every portal for integrity and connection issues, log them, and email the owner — so problems surface fast and don't sit silently.
Immutable audit trail
Every privileged action — role changes, admin creation, credential resets, agency releases, configuration changes — is written to a tamper-resistant security log with the actor, target, time, and source, and reviewed in a daily digest. Accountability is recorded, not assumed.
Continuous vulnerability scanning
Automated dependency and static-analysis scanning runs on every code change and on a schedule, so security flaws are caught and remediated on a tracked cadence — not discovered after the fact.
Backed up & recoverable
Automated backups run on managed, enterprise-grade infrastructure, so data can be restored after an incident or mistake.
Built toward government-grade compliance.
For public-sector engagements we hold to the standards that matter — and we tell you plainly where we are on each. No overstated certifications, no security theater.
Our government-readiness posture
Aligned to NIST SP 800-171
The platform is built to the control families that protect Controlled Unclassified Information (CUI): access control, audit & accountability, identity & authentication, configuration management, and system integrity. We maintain a documented System Security Plan (SSP) and a Plan of Action & Milestones (POA&M) — a self-assessment against all 14 control families, kept current as we pursue formal attestation.
Deploy inside your own boundary
Government customers can license Anchor Core to run in their own cloud tenancy (e.g. AWS GovCloud / Azure Government) — inside their existing accreditation boundary, with their identity, storage, and keys. The source and models stay ours; the data and environment stay yours.
Veteran-owned
Founded and led by a U.S. Coast Guard veteran (medically retired). Anchor Core is a veteran-owned small business. We hold no set-aside certification today, and we will never claim one we do not have pathways.
Honest on classified
Anchor Core serves CUI and below. We do not process classified information on commercial infrastructure — classified engagements are pursued only through cleared prime partners and accredited environments. We scope procurement vehicles and accreditation properly before any deployment.
The most sensitive data gets the most protection.
Financial figures, health questions, and personal information are encrypted, isolated per account, and restricted by role on the server. Sensitive collection is minimized, oversight roles are read-only, and the assistant role can't reach financials or configuration at all. Handling meets the safeguards HIPAA requires, and a HIPAA Business Associate Agreement (BAA) is available on request for protected health information.
Straight answers on security.
Is my data encrypted?
Yes — in transit (TLS/HTTPS on every request) and at rest (AES-256 on the database). Passwords are salted and hashed, never stored in plain text.
Who can actually see my data?
Only your account. Data is isolated per account with database-level row security, and within your account each role sees only what it's entitled to. Owner/executive oversight is read-only when investigating, and the assistant role is blocked from financials and configuration entirely — enforced on the server.
Do you sell or share my data?
No. Your data is yours. We do not sell, rent, or share it, and your client and agency data is never used for advertising. This is also written into your client agreement.
Where is my data stored, and is it backed up?
Data is stored in a US region on managed, SOC 2-compliant cloud infrastructure (Supabase/AWS for data, Vercel for the application) — our own SOC 2 attestation is on the roadmap — with automated backups for recovery.
What about medical and other sensitive health information?
It's protected with the safeguards HIPAA requires — minimized at collection, encrypted in transit and at rest, isolated per account, and restricted by least-privilege access with audited handling. A HIPAA Business Associate Agreement (BAA) is available on request for protected health information.
Is the platform HIPAA compliant?
Anchor Core AI runs on SOC 2-compliant infrastructure (our own SOC 2 attestation is on the roadmap) and applies the full set of safeguards HIPAA requires — encryption, least-privilege access, per-account isolation, monitoring, and audit logging. A HIPAA Business Associate Agreement (BAA) is available on request for protected health information.
What happens if there's a security incident?
Issues are logged and surfaced immediately through the monitoring system. If an incident affected your data, you'd be notified directly and promptly, with a clear account of what happened and what was done.
Can I export or delete my data?
Yes. Your data belongs to you — it can be exported, and on offboarding it is removed per your agreement. You're never locked in.
Who has access on your side?
Access is founder-led and tightly held, on a least-privilege basis. Administrative database keys are server-side only and never exposed to browsers or third parties.
Can you support government agencies?
Yes — for Controlled Unclassified Information (CUI) and below. We align to NIST SP 800-171 controls with a documented SSP and POA&M, require administrator MFA, keep an immutable audit trail of privileged actions (reviewed daily), run continuous vulnerability scanning, and can license the platform to run inside your own accredited cloud boundary (e.g. AWS GovCloud / Azure Government). We are a veteran-owned small business and hold no set-aside certification; we will never claim one we do not have. Set-aside procurement. We do not process classified information on commercial infrastructure and will say so plainly — classified work is pursued only through cleared prime partners.
Is two-factor authentication required?
For administrators, yes — MFA is required by default, and every password must meet a strong complexity standard. Sessions also end automatically after inactivity. Individual agents can enable MFA as well.
Questions about security or compliance?
Ask directly — you'll get a straight answer from the founder, not a sales script.