> ## Documentation Index
> Fetch the complete documentation index at: https://docs.songbird.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Data and compliance

> Where Songbird hosts your data, how it's encrypted, which AI providers it uses, who can access it, and where compliance stands.

***

Answers to the questions security and IT teams ask most when evaluating Songbird. For how Songbird keeps each loop in bounds, see [How Songbird loops are safer by design](/security.md).

## Infrastructure

> **Where is my data hosted?**
>
> In the United States. All stored data resides in USA-based data centers. Songbird plans to add other regions to meet regional data requirements in the future.

> **Is my data encrypted?**
>
> Yes. All data is encrypted in transit (TLS 1.2/1.3) and at rest (AES-256).

## AI and data handling

> **Which AI models does Songbird use?**
>
> Songbird uses Anthropic and OpenAI models. These may change as the frontier labs release better models. All model requests travel over encrypted API connections (HTTPS/TLS 1.2+).

> **Do AI providers train on my data?**
>
> No. Songbird uses Anthropic's commercial API, and Anthropic [documents that it does not train on customer data from its commercial products](https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training). OpenAI likewise [does not train its models on API data by default](https://openai.com/enterprise-privacy/).

> **Does Songbird train on my data?**
>
> No. Songbird does not train or fine-tune AI models on your inputs or outputs, and does not use customer data to train its own models.

> **What data does Songbird store?**
>
> Songbird stores what it needs to build, run, and explain your loops: each loop's instructions and versions, the history of its runs (including each step's inputs, tool calls, and results), the events that triggered them, and your conversations with the Songbird agent.

## Access and credentials

> **Who at Songbird can access my data?**
>
> Access to production systems is restricted to a small set of authorized engineers using MFA-protected accounts. Application and access logs are retained for operational troubleshooting and security monitoring.

> **How are my connection credentials handled?**
>
> Connection credentials are managed through Vercel Connect. Songbird never sees or stores your passwords.

> **Who in my organization can use a connection?**
>
> It depends on the connection. A personal connection only works in its owner's own loops. A shared connection works in the loops of one space. Organization apps (Slack, GitHub, and Linear) work in any loop in your Organization. Only the person who added a connection can disconnect it. See [Connections](/connections.md).

> **Can Songbird act with more access than I have?**
>
> No. The Songbird agent acts with your access, whether you use it in the app, in Slack, or from Claude or ChatGPT. It can only edit loops you can edit and use connections you can use.

## Compliance

> **Is Songbird SOC 2 compliant?**
>
> Songbird is implementing the foundational controls required for SOC 2 Type II certification, including access controls, logging, monitoring, and secure development practices. Songbird formally began the SOC 2 process in spring 2026.

> **Where can I find Songbird's privacy policy and terms?**
>
> Read the [Privacy Policy](https://www.songbird.ai/privacy) and the [Terms of Service](https://www.songbird.ai/terms).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.