No copy of your data. No third-party access. No shared infrastructure.
Invisibles deploys into your own AWS or Azure account, behind your IAM, inside your security boundary. Every customer tenant is physically separate. Your Salesforce tokens live in your cloud’s secrets store. Data residency is wherever you already run, which means GDPR, DPDP, HIPAA, and CCPA controls you’ve already written keep applying.
Architecture.
One diagram, one boundary. Everything inside the dashed line runs in your cloud account. Everything outside is either the user’s browser or the systems you already own.
Four layers of defense.
Configured from the Security section of the portal. Every layer is observable, every decision is logged.
Masking.
Field-level, regex, and cloud-native PII detection from the cloud you already pay for. AWS Comprehend on AWS, Microsoft Presidio on Azure, configurable per Prompt, per field. Free-text scrubbed before the model sees it; structured fields get typed masks.
Tokenization.
Structured records are tokenized before they reach the model. Token sessions are ephemeral with a 15-minute TTL in DynamoDB or Cosmos DB. The model sees a handle, never the value, which means a compromised prompt cannot exfiltrate real data.
Prompt-injection defenses.
Input sanitization, tool-allowlist enforcement, and output validation on every call. The model cannot invoke a tool it was not granted at Agent-authoring time. Every denied call is logged with the rule that denied it, for review.
Audit.
Every call, mask, model response, and tool invocation is logged to an immutable store. Six-year default retention, aligned to FINRA. Exportable as CSV, or streamed to your S3, Azure Blob, or Splunk instance for the review your security team already runs.
Compliance posture, honestly stated.
Your data runs in your AWS or Azure account, in the region you already chose for GDPR, DPDP, or in-country requirements. No copy. No replication. No access for Invisibles.
Invisibles operates as a processor. Controller obligations under GDPR, India DPDP, UAE PDPL, and Singapore PDPA stay with you, because the data stays in your perimeter. DPA available on request.
Deployable in HIPAA-eligible AWS and Azure regions. BAA available on request. PHI never leaves your account, so your existing HIPAA program can often extend with minimal change, subject to your own controls and review.
Invisibles is not the data controller. You maintain controller responsibilities under CCPA, CPRA, and similar US state laws. The audit log carries the evidence your privacy team needs.
Regulation-specific detail.
Every privacy program runs against a specific framework. These pages walk through how Invisibles lines up against each in the direct language privacy counsel, procurement, and security reviewers will expect.
EU General Data Protection Regulation.
Controller and processor, Article 28, Schrems II transfers, DSARs, Article 22, and how audit supports DPIA work.
Risk-tiered governance for AI systems.
Deployer obligations, transparency and oversight, GPAI model providers versus deployers, record-keeping, and rollout timing.
Digital Personal Data Protection Act, 2023.
Data Fiduciary versus Processor, consent, Data Principal rights, Significant Data Fiduciary expectations, Mumbai and Hyderabad hosting.
Privacy Act, APPs, and data sovereignty.
APP 8 cross-border disclosure, APP 11 security, Consumer Data Right, NDB readiness, and AWS Sydney or Azure Australia East deployment.
Sub-processors.
| Sub-processor | Purpose | Region |
|---|---|---|
| AWS | Compute, storage (AWS deploys) | Customer’s |
| Azure | Compute, storage (Azure deploys) | Customer’s |
| Anthropic | Optional (Claude) | Customer’s |
| OpenAI | Optional (GPT-4o) | Customer’s |
| Deepgram | Voice speech-to-text (only if the voice channel is enabled) | US |
| Salesforce | Source system (customer’s own instance) | Customer’s |
Architecture one-pager (PDF)
The diagram, the boundary, the sub-processor list. One page, share-ready for procurement.
Request DPA
Data Processing Addendum, signed, turn-around 2 business days.
Questions we get.
Where does my data physically live when I use Invisibles?
In your own AWS or Azure account, in the region you already chose for GDPR, DPDP, or in-country requirements. There is no replication to Invisibles infrastructure. No copy. No mirror. Data residency matches whatever your existing Salesforce, Microsoft Dynamics, or database deployment already honours.
Does Invisibles have access to my Salesforce data?
No. The Invisibles team has no standing access to any customer tenant. Your Salesforce OAuth tokens live in your own AWS Secrets Manager or Azure Key Vault. The runtime container executes under your IAM. Support access, if needed, is granted by you, logged in the audit trail, and revoked at will.
What certifications and compliance frameworks do you support?
Invisibles is designed to run in AWS and Azure regions used by customers pursuing SOC 2, ISO 27001, HIPAA, and equivalent frameworks. Because the software runs inside your perimeter, your existing controls can continue to apply — though any certification attestation depends on your configuration, scope, and review. DPA and BAA are available on request.
How is PII handled before it reaches the AI model?
Four layers. One, field-level masking via AWS Comprehend on AWS or Microsoft Presidio on Azure, configurable per Prompt and per field. Two, tokenization — structured values are replaced with handles that live 15 minutes in DynamoDB or Cosmos DB. Three, prompt-injection defenses with tool-allowlist enforcement and output validation. Four, an immutable 6-year audit log aligned to FINRA.
Which AI models does Invisibles use, and can I choose my own?
You pick. Default options include Amazon Bedrock (Claude, Nova) on AWS and Azure OpenAI (GPT-4o) on Azure. Self-hosted open-weight models are supported where the underlying cloud region supports them. Models are configurable per Agent, so a voice channel can use a faster model while a security-critical Skill uses a more cautious one.
Can I get a signed DPA and a BAA?
Yes. DPA turn-around is typically within 2 business days. BAA is available for deployments in HIPAA-eligible AWS and Azure regions. Request both from security@invisibles.app. Invisibles operates as a data processor under GDPR, CCPA, and equivalent regimes.
Your security team has questions we didn’t answer on this page.
Book 30 minutes. Bring whoever you need to. We’ll walk through your specific residency, DPA, and retention requirements.