Data retention policy
https://sola.security/dpa/
(Section 9, "Retention of Processed Personal Data")
Sola processes personal data only for the duration of the Agreement, per Client's instructions and for the Contracted Business Purpose. Under Section 5.3, Sola won't retain, use, or disclose personal data (CCPA-scoped) for any purpose beyond that. Data is retained only as long as needed to provide the services.
Data archiving and removal policy
https://sola.security/dpa/
(Section 9.1–9.2) Upon termination or expiration of the Agreement, and subject to Client's written request, Sola will - within a reasonable time, and in any case within 30 days — either (a) return the personal data to Client in a commercially reasonable format, or (b) delete/destroy it.
Data storage policy
Encryption-at-rest: We use the Advanced Encryption Standard (AES) algorithm with a key size of 256 bits and with a unique and proper encryption key rotation policy for each customer.
Data center location(s)
United States
Data hosting details
data lives in a tenant-isolated environment on AWS (US-east). Each tenant’s data sits in segregated storage with no shared tables or databases between customers.
App/service has sub-processors
yes
Guidelines for sub-processors
https://sola.security/dpa/#:~:text=with%20the%20CCPA.-,Sub%2DProcessing.,-Authorized%20Sub%2Dprocessors
App/service uses large language models (LLM)
yes
LLM model(s) used
OpenAI, Antropic
LLM retention settings
Zero data retention is enforced at the LLM provider level for model training. Transient processing data retained by providers (e.g., short-term abuse monitoring) follows enterprise API limits. Any customer data stored by Sola is deleted or returned within
LLM data tenancy policy
Sola uses Enterprise API tiers for OpenAI and Anthropic as sub-processors. Customer data is logically isolated per workspace, and sub-processors are contractually prohibited from using customer prompts, outputs, or data to train or improve models.
LLM data residency policy
LLM data processing occurs in US and EU regions (including Anthropic in the US). International data transfers comply with applicable privacy laws and are governed by Standard Contractual Clauses (Module II Controller-to-Processor and Module III Processor-