A summary of Marblism's publicly stated security posture, certifications, and data handling practices. All claims below are sourced from Marblism's official Trust Center.
Each statement below is paraphrased or quoted from the Marblism Trust Center.
"Cloud Application Security Assessment passed against Google's Tier 2 requirements."
Marblism's CASA Tier 2 audit was performed by TAC Security and is based on the Open Web Application Security Project (OWASP) Application Security Verification Standard (ASVS). The Letter of Validation is available as a public PDF download via the Marblism Trust Center.
"Your prompts, attachments, emails, calls and outputs are never used to train Marblism models — or any third-party model. Period."
Per the Marblism Trust Center: inference is routed to OpenAI, Anthropic, and Google under contracts that prohibit training on inference data. Customer data is isolated at the application, database, queue, and object-storage layers — AI Employees can only see the workspace they belong to.
TLS 1.2+ in transit. AES-256 at rest. Keys managed in cloud-native KMS.
Per the Marblism Trust Center: encryption keys live in cloud-native KMS, are rotated on a documented schedule, and are never exposed to staff. Customer data is stored on Amazon Web Services in regions covered by SOC 2 Type II and ISO 27001 attestations. Connected accounts and OAuth tokens are encrypted with industry-standard cryptography.
All statuses below are as published on the Marblism Trust Center.
As listed on the Marblism Trust Center. All are US-based.
A current Subprocessor List is available on request from Marblism.
Per the Marblism Trust Center: "Your prompts, attachments, emails, calls and outputs are never used to train Marblism models — or any third-party model. Period." Inference is routed to OpenAI, Anthropic, and Google under contracts that prohibit training on inference data.
Yes. Marblism states data is encrypted in transit using TLS 1.2+ and at rest using AES-256. Encryption keys live in cloud-native KMS, are rotated on a documented schedule, and are never exposed to staff.
On Amazon Web Services in regions covered by SOC 2 Type II and ISO 27001 attestations, per the Marblism Trust Center.
Per Marblism: "Workspace is deactivated immediately and customer content is deleted within 30 days, except where retention is required by law." A full data export is available on demand.
Yes. Marblism states customer data is isolated at the application, database, queue, and object-storage layers, and AI Employees can only see their assigned workspace.
Email security@marblism.com. Marblism states initial acknowledgement is sent within 24 hours and good-faith research is protected from legal action.
For the authoritative, current, and binding source of Marblism's security and compliance information, visit the official Trust Center directly.
Visit Marblism Trust Center ↗This page is operated by a Marblism strategic partner and provides a summary for convenience. All security claims, certifications, and policies are owned and maintained by Marblism. For binding documentation, refer to the official Trust Center.