FAQ

Remy has SOC 2 Type I and SOC 2 Type II reports, is GDPR compliant, and supports HIPAA through a business associate agreement that any workspace can accept in settings. The SOC 2 reports are available on the Documents page after a short NDA, and the controls they cover are monitored continuously through Vanta and listed on Controls.

Yes. On Documents, enter your name, work email and company and accept the NDA. Access is immediate; there’s no waiting for approval.

Yes, and you don’t need to talk to anyone. A workspace admin turns on HIPAA in workspace settings and accepts Remy’s BAA there. From then on, services Remy doesn’t have a BAA with are blocked for the workspace, unless you connect your own key for that service. HIPAA is $100 a month, and once it’s on, only support can turn it off. The HIPAA page lists the covered services live.

Yes. Enterprise customers can sign a data processing agreement with Remy. Contact us to start one. The DPAs Remy holds with each of its own vendors are shown, with dates, on Subprocessors.

Subprocessors lists every company that handles data whenever anyone uses Remy, with what each one receives, how long it keeps it, whether it trains on it, where it processes it, and the agreements Remy has with it. The list is read live from the same source Remy’s own product uses, so it’s always current.

A subprocessor is reached simply by using Remy: hosting, storage, sign-in. An elective service is reached only when an app uses a feature that calls it, such as a particular AI model or a search API. Elective services are listed on Model providers, Data & search and Voice & telephony, and a workspace can block any of them.

Each model provider’s training policy is shown on Model providers, stated plainly. Most don’t train on data sent through Remy. Where one does, it’s marked “Trains”, and you can block that provider for your whole workspace in settings.

Yes. Workspace admins can turn off any model provider or data service for the whole workspace. Apps in that workspace can’t call a blocked service.

Yes. A workspace can connect its own account with a vendor. Requests then run on that account, under the terms you have with the vendor directly.

Processing and storage are set separately. Processing is the compute that runs your apps and Remy itself, and it currently happens in the United States. Storage at rest is your choice. A workspace admin can set the workspace to the United States, the European Union (Frankfurt), Canada or Australia (Sydney), and everything the workspace stores at rest is written to that region. The setting can be changed at any time, and an opt-in migration moves existing data to the new region. Third-party services are listed separately: each one shows its processing region on the vendor pages, starting with Subprocessors. A service handled near the user, as a CDN is, shows as Global. Where a vendor doesn’t publish a location, the page says so.

The Data map lists every kind of data Remy keeps, who owns it, how long it lasts, and what happens when it’s deleted, including how long backup copies remain.

The data owned by it is removed. Backup copies age out within 28 days at most. A few records are kept on purpose, each with its reason shown on the Data map: billing history, and the audit log, whose events are locked for a year. Where a record has to stay so that history still makes sense, it’s stripped of names and details instead.

Email security@support.goremy.ai with the details and steps to reproduce. We acknowledge every report and keep you updated while we fix it.

Use the abuse report form at goremy.ai/abuse.

At remystatus.com.