No model training
Your data is not used to train or improve third-party AI models.
Security
Security controls before security claims.
Categoric is built by people with backgrounds in security architecture and penetration testing. We operate concrete controls now, test them continuously, and are preparing the evidence required for independent audits.
Your workspace
Accounting record
Scoped accessReviewable actionsSource evidence
Controls designed for sensitive accounting work.
AI privacy
Your accounting data stays yours.
Categoric limits how data reaches AI systems and keeps every agent result connected to the records and actions behind it.
Zero data retention
Our AI inference provider is configured for zero data retention beyond the immediate request.
Workspace isolation
Customer data remains separated through application and database enforcement layers.
Traceable agent work
Agent actions stay reviewable with the source records, proposed changes, and approvals behind them.
No selling of data
We do not sell customer data or use it for advertising.
Deletion controls
Customers can request deletion in line with the retention terms in our privacy policy.
Secure by design
Protection is built into the accounting workflow.
The product limits access, separates customer data, and keeps sensitive financial connections constrained.
Encrypted at rest
Stored data is encrypted with AES-256.
Encrypted in transit
Data in transit uses TLS 1.2 or later on every connection.
Protected bank tokens
Bank access tokens receive additional application-level encryption.
Layered tenant isolation
JWT validation, API middleware, query scoping, and database row-level security separate customer workspaces.
Strong authentication
TOTP multi-factor authentication and phishing-resistant FIDO2 passkeys are available to users.
Read-only bank access
Categoric cannot initiate payments or modify a connected bank account.
Security operations
Tested with an attacker’s perspective.
Our in-house team includes penetration-testing experts and security architecture practitioners. That experience informs how we design, review, and test the product.
Continuous code scanning
Every code change is scanned for application vulnerabilities, dependency risk, and leaked secrets before deployment.
Hands-on penetration testing
In-house offensive security expertise is used to probe trust boundaries, authorization paths, and sensitive workflows—not only run automated scanners.
Remediation and verification
Findings are evaluated, fixed according to risk, and re-tested so a closed issue represents a verified change rather than an administrative status.
Audit readiness
Building evidence before claiming compliance.
We are organizing controls, policies, ownership, and operating evidence for independent review. Formal certifications and independent audit reports are pending. Categoric does not currently represent itself as SOC 2, ISO 27001, or otherwise certified.
Security diligence
Bring us your security questions.
Enterprise partners and auditors can request our information security materials under NDA or start a focused security review with our team.