SOC 2 compliance program in progress

Security overview

At Ekai, we are committed to protecting customer data and maintaining a secure, reliable platform. Our security program is designed around industry best practices and continuously evolves to address emerging threats.

Infrastructure Security

  • Hosted on secure cloud infrastructure (AWS)
  • Virtual Private Cloud (VPC) for network isolation
  • Firewalls and security groups restrict unauthorized access
  • Continuous monitoring of infrastructure and network activity

Data Protection & Encryption

  • All data encrypted in transit using TLS 1.2+
  • Data encrypted at rest using AES-256
  • Secure key management practices implemented

Access Control

  • Role-Based Access Control (RBAC) enforced across systems
  • Principle of least privilege applied to all access
  • MFA required for privileged access
  • Regular access reviews conducted

Application Security

  • Secure Software Development Lifecycle (SDLC) practices
  • Code reviews required for all production changes
  • Automated testing and CI/CD pipelines
  • Dependency and vulnerability scanning

Monitoring & Incident Response

  • Centralized logging and monitoring
  • Real-time alerting on suspicious activity
  • Incident response plan with defined escalation procedures
  • Post-incident reviews and root cause analysis

Data Privacy & Confidentiality

  • Customer data is logically isolated
  • Access to customer data is restricted and audited
  • Employees and contractors sign confidentiality agreements

Business Continuity & Backups

  • Regular automated backups
  • Disaster recovery procedures in place
  • High availability architecture for production systems

Vendor & Third-Party Management

  • Use of trusted cloud and infrastructure providers
  • Vendors evaluated for security and compliance
  • Shared responsibility model clearly defined

Compliance & Assurance

  • SOC 2 compliance program in progress
  • Security policies reviewed and updated regularly
  • Internal risk assessments conducted

Privacy Policy

Last updated: April 2, 2026

Last reviewed: April 2, 2026

Ekai, Inc. ("Ekai", "we", "us", or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal data when you:

  • visit our websites, including https://ekai.ai and related pages;
  • use our documentation and other public-facing services;
  • request a demo, contact us, or otherwise communicate with us;
  • use Ekai-hosted products, evaluation environments, or customer support services; or
  • interact with Ekai in connection with a business relationship.

This Privacy Policy does not override any contract we have with a customer, including a master services agreement, order form, or data processing agreement. Where a customer uses Ekai on behalf of its own organization and users, that customer may control certain personal data processed through the service.

1. Who we are

Controller contact details:

Ekai, Inc.
One Broodway, c/o C10 Labs, Cambridge, MA 02142
Email: privacy@ekai.ai

2. Scope

This Privacy Policy covers:

  1. Website and marketing data collected when you browse our site, request information, book a demo, subscribe to updates, or contact us.
  2. Account and user data collected when users are invited to or use Ekai.
  3. Customer content and connected data processed through the Ekai product, subject to the deployment model and customer contract.

3. Personal data we collect

A. Website, documentation, and marketing interactions

We may collect:

  • identifiers and contact details, such as your name, work email address, phone number, company name, job title, and country;
  • communications data, such as the contents of forms, emails, support requests, meeting notes, and other messages you send us;
  • device and usage information, such as IP address, browser type, device identifiers, operating system, referring URLs, pages viewed, timestamps, and similar online activity;
  • cookie and similar technology data, subject to your browser settings and any consent choices you make.

B. Account and user administration data

If you or your organization use Ekai, we may collect:

  • user profile data, such as name, work email, organization, role, and account status;
  • authentication and access data, such as login events, invitation status, SSO or identity-provider details, and related security logs;
  • administrative and billing contact data for account owners or designated contacts.

C. Product and service data

Depending on the deployment type and features used, Ekai may process:

  • connection and configuration data for supported platforms and model providers;
  • metadata from connected data systems, such as schema definitions, table structures, column names, data types, and statistical summaries;
  • business requirements text, context documents, prompts, generated diagrams, generated code, documentation, semantic models, validation results, and review feedback;
  • usage metrics and operational telemetry, such as user counts, feature usage, execution events, and service health information;
  • logs and diagnostics needed to secure, support, maintain, and troubleshoot the service.

Where required to provide the service, Ekai may temporarily process data from connected systems during profiling, generation, validation, or execution workflows. Retention and storage vary by deployment model and contractual arrangement.

D. Data from third parties

We may receive personal data from:

  • your employer or organization, when they invite or provision you to use Ekai;
  • identity providers and single sign-on providers;
  • service providers that help us operate our website, communications, analytics, infrastructure, support, billing, and security functions;
  • publicly available sources and professional networking sources, where permitted by law.

4. How we use personal data

We use personal data to:

  • provide, operate, secure, and improve our website and services;
  • respond to inquiries, book demos, communicate with prospects and customers, and provide support;
  • provision accounts, manage user access, authenticate users, and administer organizations;
  • analyze connected systems and generate product outputs such as ERDs, semantic models, documentation, code, and related artifacts;
  • monitor reliability, site health, performance, bugs, abuse, fraud, and security incidents;
  • manage contracts, subscriptions, invoicing, and business operations;
  • send service-related communications and, where permitted, product, event, or marketing communications;
  • comply with legal obligations and enforce our terms, contracts, and policies.

We do not use customer content or connected data to train, fine-tune, or improve foundation AI models.

5. Legal bases for processing (EEA/UK only)

If EEA or UK data protection law applies, we process personal data under one or more of the following legal bases:

  • Contract: where processing is necessary to provide our services or take steps at your request before entering into a contract;
  • Legitimate interests: for operating, securing, improving, and marketing our business, provided those interests are not overridden by your rights;
  • Consent: where required, for example for certain marketing communications or non-essential cookies;
  • Legal obligation: where processing is required to comply with applicable law.

6. How we disclose personal data

We may disclose personal data to:

  • service providers and processors that support hosting, cloud infrastructure, analytics, communications, scheduling, billing, customer support, security, and other operational functions;
  • AI and model providers or infrastructure providers, where needed to provide Ekai features, depending on the deployment and configuration selected by the customer;
  • your organization and its administrators, if you use Ekai through a company account;
  • integration partners or connected platforms, at your or your organization’s direction;
  • professional advisers, auditors, and corporate transaction participants;
  • law enforcement, regulators, courts, or other third parties where required by law or necessary to protect rights, safety, or security.

We do not sell personal information and do not share personal information for cross-context behavioral advertising.

7. Cookies and similar technologies

We use cookies and similar technologies for essential site functionality, analytics, and (where applicable) marketing. You can control cookies through your browser settings; disabling some cookies may affect site functionality.

8. AI and model providers

Ekai may use third-party AI or model infrastructure providers to deliver features. The information sent to such providers may include metadata, statistical summaries, business requirement text, prompts, or generated outputs needed to perform the requested task.

We configure our services to avoid sending raw credentials, secrets, or unnecessary data for these purposes, and we do not use customer content to train foundation models.

9. International data transfers

Your personal data may be processed in countries other than the country where you reside. Where required by law, we use appropriate safeguards for cross-border transfers, such as contractual protections or other recognized transfer mechanisms.

For customer-controlled deployments, data location and transfer patterns may depend on the customer’s chosen environment and configuration.

10. Data retention

We retain personal data for only as long as necessary for the purposes described in this Privacy Policy, including to provide the services, maintain security, comply with legal obligations, resolve disputes, and enforce agreements. Our retention periods generally follow these principles:

  • Sales, demo, and contact requests: retained for the time needed to respond and manage the relationship, typically up to 12 months unless a longer business relationship exists.
  • Marketing communications data: retained until you unsubscribe or we determine the data is no longer needed.
  • Account and user records: retained for the duration of the account and for a limited period afterward, typically 90 days, unless longer retention is required for security, audit, billing, or legal reasons.
  • Security and operational logs: retained for 45 days or longer where necessary to investigate incidents, prevent abuse, or comply with legal obligations.
  • Billing and contract records: retained as required by applicable law and standard recordkeeping obligations.
  • Customer content and connected data: retained according to the applicable contract, customer instructions, and deployment model. In customer-controlled deployments, much of this data remains in the customer’s environment.

11. Your privacy rights

Depending on your location and applicable law, you may have the right to access, correct, delete, or port personal data, object to or restrict processing, withdraw consent, and opt out of marketing communications.

To exercise your rights, contact us at: privacy@ekai.ai. We may need to verify your identity before fulfilling a request. If your personal data is processed by Ekai on behalf of a business customer, please direct your request to that customer first; we support our customers in handling such requests where required.

EEA/UK residents

You may also have the right to lodge a complaint with your local supervisory authority.

California residents

You may have the right to know, correct, delete, and obtain a copy of certain personal information we hold about you, and to opt out of certain disclosures where applicable under law. We will not discriminate against you for exercising applicable privacy rights.

12. Security

We implement reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure, including access controls, encryption in transit, logging, monitoring, least-privilege practices, and vendor/security review processes. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. Children’s privacy

Ekai’s website and services are not directed to children under 16, and we do not knowingly collect personal data from children under 16.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" and/or "Last reviewed" date at the top of this page.

15. Contact us

For privacy questions or requests, contact:

Ekai, Inc.
One Broodway, c/o C10 Labs, Cambridge, MA 02142
privacy@ekai.ai

For security issue reporting, you may also contact: security@ekai.ai

News & updates