Skip to content

Security

Last updated PLACEHOLDER_DATE

Draft — not yet reviewed. This document is a starting point for counsel, not a published policy. Confirm every statement against actual practice before launch.

Where things stand

Durathink Purchase Order Agent is in active development with design partners. We hold no compliance certification and do not claim one. What follows is how the product is engineered and what we agree with each partner before any document is processed.

Engineering principles

  • Encryption in transit and at rest
  • Role-based access to orders and documents
  • Audit logging of extractions, corrections, and approvals
  • Customer-data isolation between accounts
  • Configurable retention and deletion
  • Restricted human access, limited to supporting your account

Your ERP stays yours

The agent produces an import-ready file for your team to review. It holds no credentials to your ERP and cannot post an order on its own. There is no write path from this product into your system of record.

Agreed with each design partner

  • Where documents are processed and stored
  • How long they are retained, and how deletion is requested
  • Which model providers are used and on what terms
  • Whether any data may be used for model training — off by default
  • Who on our side may access your documents, and under what controls

PLACEHOLDER: replace this section with the standard terms once they are fixed, and list sub-processors.

Reporting a vulnerability

Email admin@durathink.com. We will acknowledge your report and keep you updated while we investigate. Please give us a reasonable window to fix an issue before disclosing it publicly.