Safety

Etheon Trust & Transparency

We’re explicit about how data is used, how models are evaluated, and how decisions are governed. Explore our disclosure policy, data-use commitments, model cards, and transparency reports covering government requests and safety incidents.

Trust & transparency at Etheon

How we handle data, disclose AI-generated media, evaluate models, and protect civic processes—openly and accountably.

Child safety

CSAM hashing, age-sensitive filters, and abuse classifiers—plus rapid escalation pathways and ongoing red-teaming.

Data use & privacy

No data selling. Opt-in model training, tenant isolation, regional residency, and export/delete controls by design.

Synthetic media & provenance

C2PA metadata, watermarking, and disclosure policies to distinguish AI-generated content and reduce deepfake harm.

Fairness, bias & evaluation

Documented model cards, representative evals, and bias audits—with measurable mitigations and transparent release notes.

Civic integrity

Election safeguards: policy enforcement, rate-limiting, and partnerships to curb misinformation and coordinated abuse.

Enterprise-grade security, by design

We never train on your data

No training on private data without explicit opt-in. Tenant data is isolated and encrypted (AES-256 at rest, TLS 1.2+ in transit) with optional customer-managed keys.

Access you control

SSO/SAML or OIDC, SCIM provisioning, and least-privilege RBAC. Fine-grained project/tool permissions and immutable audit logs keep access accountable.

Controls that meet the bar

SOC 2 & ISO 27001–aligned controls, GDPR/CCPA practices, regional data residency, and model governance as we prepare for EU AI Act obligations.

How we handle your data

Straight answers on retention, training, residency, access, and encryption at Etheon.

No—unless you explicitly opt in. Tenant data is isolated. We use synthetic or opt-in datasets for evals and improvements.
Retention is configurable per workspace. Choose short default windows or set logging to zero; admin audit logs follow your policy.
Yes. Self-serve export and hard-delete APIs with audit-ready proofs. Deletions propagate across backups within defined windows.
Regional residency (e.g., EU/US). Data and backups stay in-region; keys are region-pinned. Customer-managed keys supported.
SSO/SAML + SCIM, least-privilege RBAC, and break-glass with approvals. Every access is logged and reviewable.
TLS in transit, AES-256 at rest, envelope encryption, and optional CMK. Key rotation and HSM-backed storage where available.

No—unless you explicitly opt in. Tenant data is isolated. We use synthetic or opt-in datasets for evals and improvements.

Government access & data requests

Etheon reviews every government request for user data with strict legal scrutiny. We require valid process, narrowly scope what’s requested, notify customers when allowed, and publish regular transparency reporting.

0

Non-content requests
Jan–Jun 2025

0

Content requests
Jan–Jun 2025

0

Emergency requests
Jan–Jun 2025

Child safety & online harm prevention

Etheon prevents, detects, and reports child sexual abuse material (CSAM) and grooming at scale. We use industry-standard hashing, age-sensitive classifiers, and strict policy enforcement—paired with rapid escalation and customer notification where permitted.

0

Escalations to hotlines
Jan–Jun 2025

0

Policy takedowns (CSAM/grooming)
Jan–Jun 2025

EU Digital Services Act (DSA)

Etheon provides an EU point of contact, a Notice-and-Action channel, and regular transparency reporting. Our workflows cover statements of reasons, appeals, and trusted-flagger escalation while we operate in stealth.

Avg. time to action valid notices
Rolling 6 months

Statements of reasons issued
Rolling 6 months

Appeals resolved
Rolling 6 months

EU point of contact & Notice-and-Action