The facts a security or procurement reviewer asks for first, in one place. Each one is also stated in our Privacy Policy, Terms of Service, pricing or feature catalog. Where we do not hold something a reviewer may expect, this page says so.
Who you contract with
- Entity. Ockem’s products and services are offered by Base22, LLC, the party to our Terms of Service. Base22 is a digital experience studio founded in 2007 that works with public institutions and enterprises.
- Governing law. The Terms are governed by the laws of the State of Texas, USA.
- Contact. Email info@ockem.com or use the contact form. We reply within one business day.
Where your data lives
- On infrastructure Ockem operates. No cloud hosting provider stores your documents.
- Behind Cloudflare. Cloudflare is the edge network and TLS termination for ockem.com and proof.ockem.com. It sees traffic in transit, including the pages and files served to you, and stores none of your documents.
- AI on hardware we operate. All Ockem Proof model inference runs on hardware Ockem operates, with self-hosted open models. No customer document content goes to a third-party model.
- In the United States. We are based in the United States, and the Services are provided from there.
Apart from traffic in transit through Cloudflare, the one case in which document content can leave our infrastructure is Ockem Read, an early-access product whose text generation uses Anthropic’s API. Ockem Proof documents do not leave it.
Subprocessors
The service providers that process personal data on our behalf, and what each one receives, are listed in section 5 of our Privacy Policy. We update that list before adding a new subprocessor. We do not sell personal data, and we do not share it for anyone else’s advertising or model training.
Security controls
- Tenant isolation in two layers. Every query is scoped to your organization in the application and enforced by PostgreSQL row-level security underneath. If the organization cannot be confirmed, access is refused, and automated tests that must pass before every release cover it.
- Separate storage, expiring links. Every file is stored under your organization’s own prefix. Download links expire and are re-issued on demand.
- Encryption in transit. Traffic to the Services is encrypted with TLS.
- Sign-in. Optional two-factor sign-in with an authenticator app (TOTP). On team plans, Google single sign-on or sign-in through your own identity provider (OIDC), with multi-factor authentication asserted by your provider honored and roles scoped to your organization.
- Audit trail and admin console. A structured audit trail, and a self-service admin console for people and roles, teams and access grants, security policy and audit activity.
- Backups. Nightly.
- Incident notification. If we confirm, or have reason to believe, that a security incident has affected your organization’s data, we notify you within 72 hours.
- Who at Ockem can see your documents. Access to submitted documents and personal data is restricted to personnel who need it to provide the Services. When our diagnostic records are not enough to explain a failure, an Ockem engineer may open a document to diagnose it; that access is limited to the people who need it and is never used to build a training dataset.
- Model training is off by default. Your documents train our own models only if an administrator of your workspace turns that on, or accepts it as the condition of a free evaluation. Free-trial uploads are never used for training. How training works.
How long we keep data
| What | How long |
|---|---|
| Free-trial files and assessment triage samples | Deleted automatically within 30 days. |
| Documents imported in full to prepare an assessment | Deleted 90 days after the assessment’s last activity. The analysis results and the assessment report are kept. |
| Free-evaluation workspaces | If the evaluation ends without a purchase, read-only for 30 days (unless your evaluation offer states otherwise), then scheduled for deletion 30 days later. |
| Assessment metadata | Kept for the duration of the engagement so re-crawls can skip unchanged files, then deleted on request. |
| Form submissions | Kept as long as needed to respond and maintain our business records; deleted on request. |
| Paid-service documents and certificates | Kept as agreed in your order or engagement. Certificates and their verification records are kept so issued certificates remain verifiable. |
| Server logs | Kept for a limited period for security and troubleshooting. |
The full wording is in section 4 of our Privacy Policy.
Health information and student records
Ockem Proof is not offered for documents that contain protected health information (PHI) or student education records protected by FERPA, and Ockem does not yet sign Business Associate Agreements. Please do not upload such documents to Proof, including through the free trial.
This does not apply to public documents that carry no such information, such as blank forms, notices and fact sheets.
Certificates and verification
- Every certificate carries a QR code that resolves to a public verification page on proof.ockem.com, so an auditor or a member of the public can confirm a certificate is genuine without trusting the attachment.
- Certificates and their verification records are retained so that issued certificates remain verifiable.
- A new version of a document after approval withdraws its certificate until a fresh check issues a new one. A re-issued certificate still verifies and points to its replacement.
- You download each remediated PDF together with its certificate, and can keep your own copies.
Third-party attestations
Ockem does not hold a SOC 2, StateRAMP or TX-RAMP attestation today. The controls on this page are the ones in place. If your review has its own questionnaire or contract language, send it to us at info@ockem.com.
Accessibility Conformance Report
Ockem has not yet published an Accessibility Conformance Report (ACR, the completed VPAT form) for Ockem Proof. Our accessibility statement describes where ockem.com stands, how we test it and the known issues; it does not cover the Proof application at proof.ockem.com. For questions about Proof’s accessibility, contact us.
Purchasing
- Published prices. Prices are in US dollars and published on our pricing page, with volume pricing from 2,500 documents.
- Purchase orders, at any size. Ask for a quote and we send a quote document and a W-9. On your purchase order we invoice you and add the documents to your balance. Ask for a quote.
- Card checkout is available to US organizations; elsewhere, ask for a quote and pay by invoice.
- Prepaid documents do not expire. Documents on which no remediation work has started are refundable within 30 days of purchase, as section 5 of our Terms of Service describes.
Report a security issue
If you believe you have found a vulnerability in Ockem, email security@ockem.com. We acknowledge reports within one business day. Our vulnerability disclosure policy explains what to include, what is in scope, how to test without affecting other customers, and our safe harbor for good-faith research. The same contact is published in machine-readable form at /.well-known/security.txt.
Questions this page does not answer
Email info@ockem.com or use the contact form, and tell us what your review needs. We reply within one business day.