Trust and security at ABRAM

ABRAM is built by Thomas Abram, LLC in Washington, DC. This page describes how the platform handles your data, who we share it with, and what is still in progress. It is updated whenever any of that changes. Last updated October 27, 2026.

Where ABRAM stands today. ABRAM launched in August 2026. SOC 2 and ISO 27001 are on the roadmap rather than in hand today, and the table below says where each one stands. We put that here rather than in an email six weeks into your review. What we do have is described below, in full.

Hosting and infrastructure

The full list of providers that process personal data, what each receives and where it operates is at /subprocessors.

Encryption

• Data in transit is encrypted with TLS 1.2 or higher.
• Data at rest is encrypted by our infrastructure providers.
• Payment card data never touches ABRAM infrastructure. Stripe is the processor and, for user-to-user payments, the payee is merchant of record.

Access control

• Row-level security in the database separates each organization's data, so an organization cannot read another organization's data even if an application-layer bug allowed the attempt.
• Authentication, single sign-on and SCIM directory sync run through WorkOS. SAML SSO and SCIM provisioning are available on the Enterprise plan.
• Role-based permissions govern what each member of an organization can see and do.

Your data and AI

• Your data is used to train AI models only if you give a separate opt-in consent, which is never bundled into the Terms of Use. ABRAM does not train generative AI models.
• Your organization's Organization Brain is private to your organization and is never used to train shared models, whatever your consent setting.
• Product AI features use Anthropic's commercial API. Under Anthropic's commercial terms, data sent through the API is not used to train Anthropic's models.
• ABRAM's internal AI agents, which triage errors and review changes, run on Anthropic's Claude subscription service with model training turned off. That service has no data processing agreement, and the sub-processor list marks it as our one exception.
• Work profiles are calculated in ABRAM's own database, are never sold or provided to anyone as training data, and each person can turn theirs off. The Privacy Policy describes them in full.
• AI actions that send a message, reach people outside your team, or change who can access your work wait for your approval. You see the exact content and who it affects before you approve. The assistant never sends a quote or invoice, takes a payment or moves money.
• ABRAM Vision never identifies anyone by face or voice. Frames are made searchable only after people in them are masked out, and a Vision run starts only when a person approves it.
• On paid plans you can connect Claude, ChatGPT or another AI client to ABRAM. It signs in through WorkOS, sees only what you can see, and cannot send, pay, approve, delete or invite. ABRAM logs each request without its content. What the AI client receives is handled by its provider under your agreement with them.
• On the Enterprise plan, ABRAM switches off every AI feature for an organization at an owner's request.

Privacy and data rights

• Our Data Processing Addendum forms part of the Terms of Use and applies automatically to every business customer, with no signature needed. It includes the EU Standard Contractual Clauses, the UK Addendum and the Swiss adjustments for transfers that need them, 30 days' notice of new sub-processors, and breach notice to your organization within 48 hours.
• Personal data is stored in the United States. Our sub-processors' agreements include data processing terms that address GDPR Article 28, with the one exception marked on the sub-processor list.
• Access, deletion, portability, correction and restriction requests are honored within one month under GDPR and thirty days under CCPA. Send them to privacy@abram.network.
• ABRAM does not sell personal information. On abram.network, the Meta Pixel shares visit and signup information with Meta for advertising unless you opt out; see Section 6 of the Privacy Policy. Nothing about your work in the Platform is ever shared.

Incident response

• Personal data breaches are notified to the relevant supervisory authority within 72 hours where GDPR Article 33 or applicable US state law requires it, to affected individuals without undue delay where the risk is high, and to business customers within 48 hours under our Data Processing Addendum.
• All incidents are recorded in an internal breach register.
• Report a suspected incident to security@abram.network.

Reporting a vulnerability

Email security@abram.network with the steps to reproduce the issue. We acknowledge reports within 3 business days and tell you when it is fixed. Our contact details are also published in the standard security.txt file at /.well-known/security.txt on both abram.network and app.abram.network.

We will not pursue legal action against good-faith research that follows these rules:

• Test only against your own account and your own data.
• Stop and report as soon as you reach anyone else's data, and do not keep, use or share it.
• Do not degrade the service, use denial of service, or run automated scanning at a volume that affects other users.
• Do not use social engineering, phishing or physical access.
• Keep the details private until we have fixed the issue or 90 days have passed, whichever comes first.

We do not run a paid bug bounty today.

What is in progress

We would rather you read this here than discover it in week five of a review.

Our remediation targets. Critical and emergency vulnerabilities affecting the platform within 14 days, high within 30 days, medium within 90 days.

Contact

Our legal documents: Terms of Use, Privacy Policy, Data Processing Addendum, Sub-processors, Acceptable Use Policy.