Compliance
Foldspace is built for enterprise-grade compliance. Our security and data-handling practices are independently audited against the standards enterprises require.
Certifications & standards
Section titled “Certifications & standards”
| Standard | What it covers |
|---|---|
| ISO 27001 | Certified information security management — the controls governing how we protect information. |
| SOC 2 | AICPA Service Organization Control reporting on security, availability, and confidentiality (formerly SAS 70). |
| GDPR | Compliance with the EU General Data Protection Regulation for handling personal data. |
Data residency
Section titled “Data residency”Foldspace operates data centers in both the United States and the European Union, so you can keep customer data in the region your organization requires.
Education (FERPA)
Section titled “Education (FERPA)”The Family Educational Rights and Privacy Act (FERPA) is a US federal law that protects student education records. It applies to schools and institutions that receive US Department of Education funding. Schools may share records with service providers without consent under FERPA’s “school official” exception.
A school owns its education records. An education provider runs the learning or school platform under contract with the school. Foldspace powers the agent inside that platform as a data processor: under the Data processing agreement, Foldspace processes personal data only on your documented instructions, as needed to deliver the service.
| Control | What it means | Source |
|---|---|---|
| Acts as the signed-in user | The agent acts as the authenticated user and never bypasses your app’s access controls. | FAQ |
| Verified identity | JWT authentication ties every agent request to a backend-verified user, so users can only access their own conversations. HMAC verification rejects spoofed identities on identify calls. | JWT, HMAC |
| Tenant isolation | Each session is scoped to tenant, user, and page context, with role-based access. | FAQ |
| PII masking | Mask names, email addresses, payment information, geographic locations, and IP addresses, configured per agent. | PII Control |
| No training on sensitive data | Sensitive data is never used for training. | FAQ |
| Encryption and hosting | Data is encrypted in transit and at rest, on GCP with data centers in the US and the EU. | FAQ, Data residency |
| Need-to-know staff access | Foldspace personnel access personal data only on a need-to-know basis, under confidentiality obligations. | DPA |
| Incident notification | Foldspace notifies you without undue delay after becoming aware of a personal data incident. | DPA |
| Deletion or return | At the end of the service, Foldspace deletes or returns personal data at your choice, under the terms of the DPA. | DPA |
| Listed sub-processors | Sub-processors are named in the DPA, and you can subscribe to notice of new ones. | DPA |
FERPA has no certification program. Foldspace’s audited SOC 2 Type 2 and ISO 27001 controls support customers’ FERPA obligations. To request the reports, email privacy@foldspace.ai.
Related
Section titled “Related”- Data processing agreement: the terms under which Foldspace processes your data.
- Data privacy policy: how we collect, use, and protect personal data.
- PII Control: mask personally identifiable information per agent.
For security documentation or to request our reports, contact support@foldspace.ai.
🇪🇺 EU support
Section titled “🇪🇺 EU support”Foldspace fully supports EU deployments:
- Local EU data center — data stays within the European Union.
- EU-supported models — run on EU-hosted models from Google Gemini and OpenAI.