One rule, held absolutely.

Three things stay with Stella, and only these.

Your process text. The step descriptions your team wrote. That's your own documentation, and keeping every version of it safe is the product.

Fingerprints. When real work flows through a process (an invoice, a name, a file) Stella sees only a scrambled code that says "same as before" or "different this time". The real thing is never kept, and it can't be worked out from the code.

Counters. How many runs, how long they took, what they cost. Numbers about the work, never the work itself.

Everything else is out of scope by design. Form answers, uploaded files, customer records, AI-step output: none of it is stored. Ask where we keep runtime data and the answer is we don't.

SOC 2 Type II: attested, through Tallyfy, Inc. An independent auditor has examined the controls in operation over time, not just on paper.

GDPR: Tallyfy participates in the EU-U.S. Data Privacy Framework for transfers, and a signed DPA is available for the asking.

HIPAA: if your work touches health information, we'll sign a Business Associate Agreement on request.

The straight answer on everything else: we don't hold HITRUST, ISO 27001 or FedRAMP and won't imply otherwise. If your checklist needs something not listed here, ask. You'll get a plain yes or no.

Stella gets smarter across her whole customer base, so it's fair to ask what travels between companies.

The answer: the shape of an improvement and its track record. Never your text. Not a step, not a sentence, not a word written by your team is ever shown to or reused for anyone else.

Two more guardrails. A pattern must appear in at least three companies before it's reused anywhere, so nothing traces back to any one of them. And you can opt out entirely; Stella works the same for you either way.