Soraban

What the vendor says

Answers the vendor publishes to questions buyers ask, quoted with the link to where it says so.

• Where data is hosted or processed

  Where is customer data hosted, and is it US-only?

  “All customer and client data is processed and stored exclusively in U.S. AWS regions. Soraban does not replicate, back up, or transfer data outside of U.S. borders.”

  as of 21 Sep 2026Source

• Encryption

  How is data encrypted at rest and in transit?

  “Data at rest is encrypted using AES-256. Application databases and document storage both use industry-standard server-side encryption with versioning and access logging enabled. Data in transit is protected with TLS 1.2 or higher, with HTTP Strict Transport Security (HSTS) enforced on all client-facing surfaces. Access to encryption keys is restricted to authorized personnel with a documented business need.”

  as of 21 Sep 2026Source

• Use of customer data to train models

  Is customer or client data used to train AI models?

  “No. Soraban does not train any AI models on customer or client data. Our AI sub-processors operate under Zero Data Retention terms and are contractually prohibited from using Soraban customer data to train their models. Soraban does not sell or share customer data for advertising or any other unrelated purpose.”

  as of 21 Sep 2026Source

• Penetration testing

  How often do you conduct penetration tests?

  “Soraban engages an independent third party to conduct penetration testing on at least an annual basis. All critical and high-priority findings are remediated and verified by management. Automated vulnerability scans run continuously across production systems. A summary of the most recent penetration test is available to customers and prospects under NDA.”

  as of 21 Sep 2026Source

• Data retention and deletion

  How long does Soraban retain our data, backups, and system logs?

  “To comply with contractual, regulatory, and operational requirements, including IRS, CRA, and FTC Safeguards obligations (SOC 2 CC2.1, C1.2), Soraban retains data for at least the minimum required duration and reserves the right to store data indefinitely (which the exception of when a permanent data deletion request is made). Database backups are retained for up to 35 days, and system logs are retained for up to...”

  as of 21 Sep 2026Source

• Data retention and deletion

  What happens to our data in backups and logs after we request deletion?

  “Clients may request deletion of their client and customer data, which is removed from active production systems and is no longer accessible (SOC 2 C1.2). Client-uploaded files and associated records are permanently deleted from primary datastores (SOC 2 CC6.5). Client and customer data that may exist in logs or backups is retained only for the duration of defined retention periods and is not immediately removed as...”

  as of 21 Sep 2026Source

• Data retention and deletion

  How long do AI providers retain customer data?

  “Soraban's AI sub-processors operate under Zero Data Retention terms. Customer data sent for document recognition and data extraction is processed to return a result and is not retained afterward. Sub-processors may use customer data only to perform the requested task on Soraban's behalf, and it is never used to train or improve AI models.”

  as of 21 Sep 2026Source