Your design packages stay yours

Bunyan runs in the Riyadh region. Files, page images, parsed text, findings, exports and backups are stored in Saudi Arabia, and the AI models we use are hosted in Saudi Arabia.

Every request is scoped to your organization on the server, and the database enforces the same rule a second time with row level security. Guests see only the projects they were invited to.

Connections to Bunyan use TLS. Sign-in secrets such as two factor keys are encrypted in the database, passwords are hashed with Argon2id, and backups are encrypted before they leave the server.

Two factor sign in, single sign on with Microsoft Entra, Google or SAML, and per organization enforcement. Bunyan staff cannot open your projects unless an Owner grants time boxed, read only access, and every staff view is written to your audit trail.

Your documents are used only to run your audits and drafts. They are never used to train or fine tune a model. Each AI job runs in its own sandbox that sees only that job's files.

Every upload is scanned for malware before it is read, checked by its real file type and size, and served back only through short lived links from a separate domain.

Files are kept while your organization is subscribed. An Owner can delete a project and restore it for 7 days, or delete it at once. After cancellation, everything is deleted 30 days later, and the Owner receives a deletion receipt.