Security at Attune

Last Updated: September 25, 2026

Attune is an AI-powered research platform provided by Clozd, Inc. Interviews run on Attune produce some of the most sensitive material a research team handles — recorded conversations with real customers. This page describes how we protect that information.

Compliance

Attune is built and operated inside Clozd’s SOC 2 Type II environment, under the same information security program, policies, and control framework that govern our other services.

Attune is being added to the scope of our next SOC 2 audit. Until that audit is complete, we do not claim a SOC 2 attestation or ISO 27001 certification covering Attune itself, and we will say so plainly rather than imply otherwise.

Current reports, policies, and control documentation are available through the Clozd trust center at trust.clozd.com.

Encryption

In transit. All traffic to Attune is served over HTTPS. Plain HTTP requests are redirected to HTTPS, and our content delivery and API edges negotiate a minimum of TLS 1.2. Every Attune storage bucket carries a policy that refuses any request not made over TLS.

At rest. Every Attune database runs with storage encryption enabled. Interview recordings, transcripts, and related research artifacts are encrypted with a dedicated AWS KMS key with automatic key rotation enabled. Our caching layer is encrypted at rest and in transit, and account-level default encryption is enabled for block storage.

Where Your Data Is Stored

Attune production data is hosted on Amazon Web Services in the US East (N. Virginia) region, us-east-1, in the United States. Production and non-production environments run in separate AWS accounts.

For disaster recovery, backups and stored artifacts are replicated to the US West (Oregon) region, us-west-2. Attune does not host customer data outside the United States.

Interview Recordings and Transcripts

Recordings and transcripts are written to a private, versioned storage bucket that blocks all public access and is encrypted with its own KMS key.

The recording pipeline writes using a credential scoped to a single prefix that cannot read objects back.
Application access is granted per prefix. No component holds blanket access to the bucket.
Playback is served through short-lived pre-signed links that expire 15 minutes after they are issued. The underlying objects are never publicly readable.
Object-level reads and writes are recorded to a separate audit trail with log file validation enabled, so tampering with the audit record is detectable.

Retention of research information is governed by the agreement with the customer who commissioned the research. See the Data Processing Addendum and the Participant Privacy Notice.

Network and Access Controls

Each Attune environment runs in its own virtual private cloud.

Databases sit in private subnets, are not publicly accessible, and accept connections only from an explicitly authorized security group.
Public traffic terminates at a managed API gateway and reaches application services over a private link to an internal load balancer that has no public address.
Storage buckets holding customer or participant data have public access blocked at the account and bucket level.
Production runs continuous threat detection, vulnerability scanning, posture monitoring, permissions analysis, and network flow logging.

Authentication and Authorization

Access to the Attune platform is managed by a dedicated identity provider. Sessions are issued as signed tokens and verified at the API edge on every request, with a separate identity environment per deployment.

Authorization is resolved against Attune’s own records: every request is scoped to the organization the user belongs to, so data cannot be read across customer boundaries.

Research participants never create an account or a password. They join through a single-use tokenized invitation link, and their session is held in a signed, HTTP-only, secure cookie for the duration of the interview.

Logging, Monitoring, and Audit

Application logs are retained for one year and forwarded to our observability platform, alongside distributed tracing and runtime metrics.
Object-level access to the artifact store is captured in a dedicated audit trail; a second account-wide trail covers all storage.
Audit logs are written to a bucket protected by object lock, so records cannot be altered or deleted for one year.
Administrative shell sessions into running services are logged and retained for one year.
Infrastructure and application alarms page an on-call engineer.

Resilience and Backups

Production databases run across multiple availability zones with automated daily backups retained for seven days, and a final snapshot is taken before any database is decommissioned. Stored artifacts and audit logs are replicated to the US West (Oregon) region, us-west-2.

AI and Your Data

Attune does not use customer or participant personal data to train or fine-tune general-purpose AI models, and we contractually require the AI providers we use not to train on it either. These commitments are set out in our Data Processing Addendum.

Subprocessors

We publish the third parties that may process customer personal data in connection with Attune, along with what each one does and where it operates. See the Subprocessor List.

We give customers at least thirty (30) days’ advance notice before a new subprocessor begins processing customer personal data, as described in the Data Processing Addendum.

Reporting a Security Issue

If you believe you have found a vulnerability in Attune, email security@tryattune.ai. Please include enough detail for us to reproduce the issue, and give us a reasonable opportunity to address it before disclosing it publicly.

For privacy questions or to exercise a privacy right, contact privacy@tryattune.ai instead.

Attune
Provided by Clozd, Inc.
1300 W Traverse Parkway Suite 400
Lehi, UT 84043 USA
security@tryattune.ai