Security
Last updated September 2026
Anara is trusted by the teams behind work that is audited, submitted, and defended: regulatory and medical affairs in pharma and biotech, clinical and healthcare organizations, and the consultancies that support them. When your research has to clear a regulator, a client, or your own security team, how we handle your data matters as much as the answers we return. We hold the certifications enterprise procurement requires and encrypt your data in transit and at rest. The sections below detail how we protect your data at every layer. You can also browse all of our compliance documentation in our Trust Center.
Independently audited against the AICPA Security Trust Services Criteria (SOC 2 Type II). Request SOC 2 →
Certified to ISO/IEC 27001:2022 for our information security management system. Request ISO 27001 →
Compliant with the EU General Data Protection Regulation.
Safeguards for protected health information. BAA available on request for Enterprise customers. Request BAA →
Certifications and third-party assessments
Anara is SOC 2 Type II and ISO/IEC 27001:2022 certified, and compliant with GDPR. Our SOC 2 report covers the Security trust services criteria and is the product of an independent third-party audit. We maintain a formal information security management system under ISO 27001 with documented policies, risk assessments, and internal audits.
Current customers and qualified prospects can access our SOC 2 report, ISO 27001 certificate, and other compliance documentation through our Trust Center.
AI processing and data retention
Anara answers questions by retrieving the passages relevant to your query and sending only those to the AI provider that generates the response. Your full library never leaves our systems for this. Our model providers include OpenAI, Anthropic, Google and xAI.
We operate under zero data retention (ZDR) terms with all of our LLM providers. Once a request is processed, your prompts and the retrieved passages are not retained on their systems. They exist only for the moment it takes to generate your answer.
Encryption
All data is encrypted in transit with TLS 1.2 or higher and encrypted at rest with AES-256. This covers your uploaded documents, the text and embeddings we derive from them, your notes and chats, and everything stored in our databases and object storage.
Infrastructure security
Anara runs on established United States cloud infrastructure: Amazon Web Services as our primary platform, alongside Vercel, Google Cloud, Microsoft Azure, and Cloudflare. Every provider that hosts or processes data is listed on our subprocessors page.
Application services run in isolated private networks. Stored files are kept in object storage that is not publicly accessible and is served only through short-lived signed URLs. Our infrastructure is defined and managed as code, so every change is version-controlled, reviewed, and reproducible.
Application and access security
Internal access to production systems follows the principle of least privilege and requires multi-factor authentication. Security-relevant events, including authentication and two-factor changes, are recorded in an audit log.
Every user can turn on two-factor authentication using an authenticator app with backup codes. Enterprise workspaces add single sign-on (SSO) over SAML, SCIM user provisioning, and admin controls so security teams can manage access and offboarding centrally. We also use device fingerprinting to detect and block fraudulent account activity.
Healthcare data and HIPAA
HIPAA support is available on request for customers working with protected health information (PHI). When HIPAA mode is enabled for an organization, PHI is routed to isolated storage with its own access controls and signed-URL delivery, AI processing runs through HIPAA-eligible model endpoints, and sensitive events are written to a dedicated audit log.
We provide a Business Associate Agreement (BAA) for Enterprise customers who handle PHI. Contact us through the Trust Center to request one.
Data ownership and deletion
Your content is yours. You can export your library at any time, and you can delete files, notes, or an entire workspace from your settings. When you delete a workspace, its data is removed from our systems.
Under GDPR and similar regulations, you can request access to or erasure of your personal data by emailing support@anara.com.
Data residency and subprocessors
Anara processes data in the United States. We rely on a vetted set of subprocessors to operate the service, each held to our security and privacy requirements. You can review them on our subprocessors page.
A Data Processing Agreement (DPA) is available for signature at anara.com/dpa, where you can review and sign it online. For transfers of personal data out of the EU, we rely on Standard Contractual Clauses.
Business continuity and reliability
We maintain a documented business continuity and disaster recovery plan with defined recovery objectives, and our databases are backed up automatically. Live system status and incident history are published at status.anara.com.
Secure development and monitoring
Changes to Anara go through a secure development lifecycle. Code is peer reviewed before it reaches production, and infrastructure changes are version-controlled and reviewed the same way.
We continuously monitor production with error and performance tracking, so we detect and respond to issues quickly. Sensitive workloads run in isolated, sandboxed environments separated from the rest of the system.
Reporting a vulnerability
We welcome responsible disclosure from the security community. If you believe you have found a security vulnerability, please email security@anara.com with the details. We investigate every report, keep you updated on our progress, and notify affected customers of any confirmed incident.
Frequently asked questions
To answer a question, Anara sends only the passages relevant to your query, not your whole library, to the AI provider that generates the response, such as OpenAI, Anthropic, Google or xAI. We operate under zero data retention (ZDR) terms, so your data is not stored on their systems once a request is processed.
Yes. All data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256. This covers your uploaded documents, the text and embeddings we derive from them, your notes and chats, and everything in our databases and object storage.
Anara processes and stores data in the United States, primarily on Amazon Web Services. The full list of hosting and infrastructure providers is on our subprocessors page. EU-only data residency is not available today. For transfers of EU personal data we rely on Standard Contractual Clauses, and a DPA is available for signature at anara.com/dpa.
Anara is SOC 2 Type II and ISO/IEC 27001:2022 certified, and compliant with GDPR. To request our SOC 2 report, ISO 27001 certificate, or other compliance documentation, email security@anara.com or visit our Trust Center.
Yes, on request. Enterprise customers who work with protected health information can sign a Business Associate Agreement. With HIPAA mode on, health data is kept in isolated storage with its own access controls, and AI processing runs only through endpoints covered by a BAA. Email security@anara.com to get started.
Yes. A Data Processing Agreement is available for signature at anara.com/dpa. For transfers of personal data out of the EU, we rely on Standard Contractual Clauses.
Our AI providers include OpenAI, Anthropic, Google and xAI. Every subprocessor, including AI, hosting and infrastructure providers, is listed on our subprocessors page.
Your library is private to you and the people you share it with, through folder sharing or a share link you create. We never share your content with other customers. Internal access to production systems is restricted on a least-privilege basis, requires multi-factor authentication, and is logged.
Yes. You can delete files, notes, or an entire workspace from your settings, and deleted data is removed from our systems. Backup copies expire within 90 days. You can also request erasure of your personal data under GDPR by emailing support@anara.com.
Yes. Enterprise workspaces include single sign-on (SSO) over SAML, SCIM user provisioning, and admin controls for centralized access management and offboarding. Every user can also enable two-factor authentication with an authenticator app.
Email security@anara.com or visit our Trust Center for our SOC 2 report, ISO 27001 certificate, DPA, and other documentation. We are happy to support your security questionnaire and review process.
Your Privacy Choices