Trust Center

1. Executive Summary

Prepp is an AI-powered sales onboarding platform that helps sales teams reach competency faster through guided practice, roleplay, and manager-visible progress insights.

2. Product Overview

What Prepp Does

• Content onboarding: Admins upload approved product playbooks and training materials
• AI coaching: Sales reps complete guided practice and roleplays with an AI coach
• Manager insights: Managers review aggregated progress and coaching outcomes

Key Workflows

Admin uploads content → Rep practices with AI coach → Manager reviews progress

3. Architecture & Data Flow

High-Level Architecture

Infrastructure Components

Data Residency

• Primary region: GCP Israel (me-west1)
• Data stored in Israel: Application data, user profiles, coaching logs, recordings
• Data leaving Israel: LLM processing requests (prompts and responses) are sent to OpenAI/Anthropic servers in the US. No customer PII is required in these requests.

4. Authentication & Access Control

Identity & SSO

Role-Based Access Control (RBAC)

Audit Logging

• Sign-in events
• Administrative actions
• Content changes
• Export available on request

5. Data Handling

Data We Collect

Data We Do NOT Require

• ❌ Customer PII (social security, ID numbers, etc.)
• ❌ Sensitive customer records
• ❌ Call recordings (unless explicitly enabled)
• ❌ Integration with CRM/HR systems

Tenant Isolation

Multi-tenant SaaS with logical tenant separation. All records are scoped by organization_id with org-scoped queries enforced at the service layer.

6. Encryption

In Transit

At Rest

Key Management

• Encryption keys managed by GCP
• Customer-managed encryption keys (CMEK) available on request

7. Security Controls

Network Security

• Cloud Run services deployed in GCP Israel region
• Private VPC connector for database access
• HTTPS-only ingress with TLS 1.2+
• Hatchet workflow engine runs on an internal-only GCE VM with firewall rules restricting access to the VPC connector IP range
• Hatchet dashboard access via HTTPS load balancer with Google Identity-Aware Proxy (IAP); only authorized Google accounts can reach the UI
• Cloud Armor available for WAF/DDoS protection on request

Secure Development Lifecycle (SDLC)

• Code review required for all changes (PR-based workflow)
• CI pipeline with automated tests and linting
• Dependency scanning via Dependabot
• Secret scanning in CI
• Staging environment for pre-production validation

Logging & Monitoring

• Application logs in GCP Cloud Logging
• Audit logs for sign-ins, admin actions, content changes
• Alerting via GCP Cloud Monitoring
• SIEM integration available on request (log export supported)

Backup & Recovery Testing

• Automated daily backups for Cloud SQL
• Quarterly restore testing schedule
• RPO 24 hours; RTO 48 hours

8. AI Governance

LLM Providers

Data Usage Policy

LLM Data Retention (Provider Side)

Note: OpenAI explicitly states: "Data sent to the OpenAI API is not used to train or improve OpenAI models."

9. Data Retention & Deletion

Default Retention

Configurable Options

• Retention windows adjustable per customer contract
• Opt-out of storing prompts/responses available
• Voice recordings can be disabled entirely

Deletion Process

10. Security Operations

Vulnerability Management

Detection Methods

• Weekly dependency scans (CI)
• Dependabot alerts and automated PRs
• Cloud provider security alerts
• Manual review of major advisories

Penetration Testing

Incident Response

Severity Levels

Security Contact

• Email: security@prepp.tech
• Response: Within 24 hours

11. Business Continuity

Backup Strategy

Recovery Objectives

Disaster Recovery

• Zonal Cloud SQL in GCP Israel with automated backups + PITR
• HA/failover available when regional Cloud SQL is enabled
• Quarterly restore testing

Service Availability

12. Compliance Status

Current Status

Compliance Roadmap

Israel Privacy Law (חוק הגנת הפרטיות)

13. Subprocessors

14. Contact Information

This document consolidates Prepp's security and compliance information for enterprise due diligence. For additional questions, contact security@prepp.tech.