Your training material is often the most sensitive document a company owns. This page sets out exactly how we handle it — including the parts most vendors leave out.
We do not use your uploaded documents, voice recordings, photographs or workforce records to train, fine-tune or improve any model — ours or anyone else's. Custom trainers and voices are partitioned to your organisation and are never applied to another customer's output. We do not sell personal data and we do not share it with advertisers or data brokers.
The question enterprise reviewers ask most, and the one most answers dodge. Ours has two parts.
These stages run on models we host on compute we control. That content is not sent to any external model provider. Most tools in this category assemble calls to third-party generation APIs; we do not, and it is our single strongest data-protection property.
To produce the lesson blueprint, the relevant source text is processed by an enterprise AI service under terms that prohibit training on customer data. Your text is processed and returned — it does not become anyone's training data. If your policy prohibits third-party model processing entirely, raise it during evaluation; it is addressable under an enterprise agreement.
The measures that apply to every account, on every plan.
TLS 1.3 enforced on every endpoint. HTTP is redirected, never served.
AES-256 server-side encryption on all databases and object storage.
Every record is keyed to its organisation, and authorisation is evaluated on each request rather than trusted from the browser.
Administrator sign-in is delegated to a managed identity provider, and employee PINs are stored only as salted hashes.
Training films stream through short-lived, signed authorisations verified per request. A copied link stops working.
Payments are handled entirely by a PCI-DSS compliant processor. Card details never reach our systems.
Administrative surfaces are gated by a server-side allowlist that denies access when it is unset or unreadable.
A global network with DDoS mitigation and a web application firewall in front of every public endpoint.
We separate where data is stored from where it is briefly processed, because those are different answers and merging them would misrepresent our position.
All databases and object storage: accounts, workforce records, certificates, source documents, generated courses, invoices.
Rendering and inference run in India, Singapore, the United States and Europe. Content is held only for the duration of the job, then written back.
We do not transfer personal data to any territory restricted by the Government of India under Section 16 of the DPDP Act, 2023.
Available under an enterprise agreement, not on self-serve plans. Raise it before onboarding, not after.
Every store has an enforced bound, applied on a timer that runs whether or not anyone ever signs in again. Retention that only triggers when an owner returns retains nothing for inactive accounts — precisely the data that should age out.
| Data | Bound |
|---|---|
| Workforce records and certificates | For the life of the organisation’s account, so certificates stay checkable; deletable at any time |
| Source documents and generated courses | Kept with the course so it can be revised; deleted with the course or account |
| Custom voice models and recordings | Maximum 20 per account, deleted 90 days after last use |
| Intermediate production files | 72 hours — purged immediately on delivery |
| Temporary production workspaces | 24 hours |
| Job logs | 6 hours |
| Account deletion | 30-day restorable grace period, then permanent purge |
| Invoices and financial records | Retained as required by Indian law (up to 8 years) |
By category and region. Customers receive the current named list with our Data Processing Agreement, and we give notice before adding any sub-processor that processes customer content.
| Category | Region |
|---|---|
| Cloud hosting, databases and object storage | Asia-Pacific |
| Edge network, DDoS protection and firewall | Global edge |
| Compute for rendering and inference (operated by us) | India, Singapore, United States, Europe |
| Enterprise AI services for planning and writing stages | United States |
| Identity and sign-in | Global |
| Transactional email | Global |
| Payment processing | India |
| Job queueing and short-lived cache | Asia-Pacific |
We would rather lose a deal on this section than win one and fail diligence later.
Formal certification will be pursued as our enterprise customers require it. If it is a hard gate for your organisation, tell us — knowing a real contract depends on it changes when we start.
Each opens as a readable page with a contents rail, and prints straight to PDF if your procurement process needs a file.
Email admin@examiverse.com with “Security” in the subject. We do not pursue researchers who report in good faith, allow reasonable time to remediate, and do not access or destroy other users' data.
Darshan A C, Grievance Officer & Co-founder — admin@examiverse.com. Acknowledged within 24 hours, resolved within 30 days.
Examiverse Technologies Private Limited · CIN U62011KA2026PTC214753 · 73, KST Town, Valagerehalli, Kengeri, Bangalore South, Bengaluru – 560060, Karnataka, India
