For procurement, security, and legal reviewers.
FellowHire is SOC 2 and ISO 27001 compliant. Customer data is encrypted in transit and at rest. We use no-training enterprise agreements with our model providers. Everything below is the longer version.
SOC 2
Compliant
ISO 27001
Compliant
AES-256
Encryption at rest
TLS 1.3
Encryption in transit
| Topic | FellowHire posture |
|---|---|
| Compliance frameworks | SOC 2, ISO 27001 |
| Encryption in transit | TLS 1.3 |
| Encryption at rest | AES-256 |
| Hosting | AWS, US regions (EU on request) |
| Customer environment | Isolated AWS Enclave per customer |
| Model training on your data | Never |
| Model providers | OpenAI, Anthropic (no-training enterprise agreements) |
| Data residency | US default; EU available on request |
| Access controls | Role-based, scoped during fellow setup |
| Audit logs | Yes, retained per SOC 2 requirements |
| Customer data deletion | On request, or at end of engagement |
| DPA available | Yes |
| Sub-processors | Listed below |
When you bring on a fellow, you decide what your fellow can see. During setup, we scope which Slack channels, which Teams channels, which integrations, and which documents the fellow has access to. The fellow only operates within those scopes. You can revoke any scope at any time.
When the fellow does work, like drafting an email, summarizing a document, or running a competitor brief, the work happens in your isolated AWS Enclave. Data is encrypted in transit and at rest the whole way through.
When the fellow needs to call a model (OpenAI or Anthropic), the call goes out over an encrypted enterprise connection. We use no-training enterprise agreements with both providers. Your data is not used to train their models. Ever. Full stop.
When the fellow integrates with another tool (HubSpot, Salesforce, Clio, Google Workspace, etc.), it uses OAuth scopes you approved during setup. You can revoke any integration at any time. Revoking a scope stops the fellow from using that scope on the next call.
When you end an engagement, customer data is deleted on request or at the end of the engagement per the DPA. Audit logs are retained per SOC 2 requirements and then deleted.
Never train on your data.
No exceptions. Not for product improvement. Not for model fine-tuning. Not in aggregate. Not anonymized.
Never share your data with other customers.
Each customer runs in an isolated AWS Enclave. Your data does not commingle.
Never sell, rent, or expose your data to advertisers.
This is not an ad-funded business.
Never give your data to model providers for training.
Our agreements with OpenAI and Anthropic explicitly bar training on customer data.
Never give the fellow access to scopes you did not approve.
If it was not connected during setup, the fellow cannot see it.
Never read customer data without an audit trail.
When FellowHire staff need to access customer data (rare, only with customer permission), it is logged and reviewable.
FellowHire is SOC 2 and ISO 27001 compliant. Everything we have built — infrastructure, data handling, access controls, audit trails — is built to meet both standards. Customer data is encrypted in transit (TLS 1.3) and at rest (AES-256). We use no-training enterprise agreements with our model providers (OpenAI, Anthropic).
SOC 2
SOC 2 is the standard most US-based buyers ask for. Our SOC 2 controls cover security, availability, processing integrity, confidentiality, and privacy. Audit reports are available under NDA during procurement review.
ISO 27001
ISO 27001 is the international standard for information security management systems. Our ISMS covers the same posture as our SOC 2 program with the additional structure ISO 27001 requires. Reports available under NDA.
Audit Reports
We share SOC 2 and ISO 27001 audit detail under mutual NDA during procurement. To request, click below or email [email protected].
Request audit reports →Encryption in transit.
All connections to and from FellowHire use TLS 1.3. This includes Slack, Teams, integrations, and model provider calls.
Encryption at rest.
All customer data at rest is encrypted with AES-256.
Hosting.
FellowHire runs on AWS in US regions by default. EU regions are available on request.
Customer isolation.
Each customer runs in an isolated AWS Enclave. There is no shared compute between customers. There is no shared storage between customers. Your fellow does not have access to anything outside your environment.
Built on OpenClaw.
FellowHire is built on the OpenClaw platform. Each fellow runs in a sandboxed environment with the integrations and access scopes you approved.
Role-based access.
Customer access controls are role-based. Your team grants access to the fellow during setup. We do not have default access to your data.
FellowHire staff access.
Staff access to production systems is least-privilege, logged, and reviewed. Engineers do not access customer data without explicit customer permission and an audit trail.
Audit logs.
Every fellow action and every integration call is logged. Logs are retained per SOC 2 requirements. Logs are available to you on request.
Revocation.
You can revoke any scope, any integration, or the entire fellow at any time from your workspace settings. Revocation takes effect on the next call.
Providers.
FellowHire uses OpenAI and Anthropic as the primary model providers. Both relationships use enterprise-tier no-training agreements.
No training on your data.
Customer prompts, customer data, and customer outputs are never used to train models. This is contractually enforced with both providers.
Provider data retention.
Provider-side retention follows the enterprise zero-retention configuration where available, and the standard enterprise retention window otherwise. Detail is available in our DPA.
Model output review.
Fellows draft and summarize. Where output is sensitive (legal documents, financial reports, customer-facing copy), our recommended workflow is human review before send. We do not market fellows as replacements for the human in the loop on high-stakes work.
Data residency. Customer data is stored in AWS US regions by default. EU residency is available on request for European customers and customers with regulatory requirements.
Sub-processors. The list below is current as of this page's last update. Updates are posted here and notified per DPA.
| Sub-processor | Purpose | Region |
|---|---|---|
| Amazon Web Services | Hosting and storage | US (or EU on request) |
| OpenAI | Model provider (no training) | US |
| Anthropic | Model provider (no training) | US |
During engagement.
You can delete customer data from your workspace at any time. Audit logs are retained per SOC 2.
End of engagement.
When an engagement ends, customer data is deleted within 30 days on request, or per the timeline in your DPA. Audit logs are retained per SOC 2 retention requirements and then deleted.
Export.
You can request a full data export at any time. Format and timing are described in the DPA.
Data Processing Agreement. We provide a DPA with every annual engagement. Pilot agreements include a short-form data handling addendum. Full DPA is available on request before contract signature.
Custom DPA. For Scale-tier customers and customers with specific procurement requirements, we accept reasonable custom DPA edits. Reach out via the form below.
If you believe you have found a security vulnerability in FellowHire, email [email protected]. We respond within 1 business day. We do not pursue legal action against good-faith security researchers who follow responsible disclosure.
Yes. SOC 2 audit reports are available under NDA during procurement.
Yes. ISO 27001 audit reports are available under NDA during procurement.
AWS US regions by default. EU regions on request.
Never. We have no-training enterprise agreements with OpenAI and Anthropic. Customer data is contractually barred from training use.
No. The fellow only operates within scopes you approved during setup. You can revoke any scope at any time.
Yes. The DPA is provided with every annual engagement and is available on request during procurement.
Bring them to a 30-minute call with our team. We will go through your specific procurement and risk-management requirements together.