Built on a foundation of trust.

Data in Transit & At Rest

All data transmitted to and from Theoremic is encrypted using TLS 1.2 or higher. Data at rest is encrypted using AES-256. We do not store raw ERP data beyond what is necessary to execute an active workflow.

Deployed in Your Environment

Theoremic runs inside your own cloud account, with per-tenant isolation. There is no shared data plane, and no vendor-side copy of your spend universe to secure, govern or exit.

We Read, We Do Not Replicate

The Data Spine assembles a view on demand. Source documents remain in your storage; we hold references, not files.

Access Controls

Role-based access at the platform level. Every agent action is scoped to permissions granted explicitly at deployment. No agent reads, writes or acts outside its defined operational boundary.

Human in the Loop by Design

Decisions above defined risk thresholds are surfaced to human reviewers before execution. Automation does not mean unattended — it means precise, auditable and accountable.

Full Audit Trail

Every decision, action and escalation is logged with its inputs, reasoning, confidence and citation, with timestamps and actor context. Exportable.

No Training on Customer Data

Your data never trains shared models, and is never surfaced across tenant boundaries under any circumstances.

Our Current Posture

We are an early-stage company actively building toward formal certifications. We operate with the security discipline and internal controls consistent with enterprise SaaS standards, and we are on a clear path toward SOC 2 Type II attestation.

Integration Standards

We connect through the integration layer you already run, or through standard enterprise APIs and Model Context Protocol. Our approach does not require privileged system access or custom connectors that introduce additional risk surface.

Data Residency

We work with enterprise partners to confirm data residency requirements as part of any engagement — including where the decision record and evidence store reside, and what options exist.

Security Inquiries

Enterprise partners with specific security or compliance questions are encouraged to contact our founding team directly. We are available to discuss architecture, data handling and specific requirements as part of any engagement.

Responsible Disclosure

If you believe you have identified a security vulnerability, we ask that you notify us before public disclosure. Write to security@theoremic.com and we will respond within 48 hours. See our full responsible disclosure policy →.