Protect revenue. Release cash. Prevent disruption. Govern enterprise AI. Connect your organization and watch problems move from detected → verified in the Decision Queue. Start the 11-step connection wizard →
How the connection works
Stage 1
SAP, Oracle, Salesforce, Blue Yonder — runs in your environment, untouched.
Stage 2
We authenticate with the narrowest possible read scopes. Tokens encrypted at rest.
Stage 3
Queries stream through our compute. Aggregates + signals are computed in memory.
Stage 4
Only fill-rate %, churn scores, margin flags persist. Source rows discarded.
Data residency · in plain English
What DuluthPath stores
What we never store
Certifications & frameworks
SOC 2 Type II
Ready
External audit window: Q4 2026 — no certification claimed yet
ISO 27001
Roadmap
Targeting Q4
GDPR
Compliant
EU data residency support live
HIPAA
Roadmap
Healthcare BAA available on request
SOC 2-Ready · Audit Q4 2026
DuluthPath operates the control set required by the AICPA Trust Services Criteria (Security + Availability) — evaluated live against the running system. Our external Type II audit window is scheduled for Q4 2026. Until an independent CPA has issued the attestation, no SOC 2 certification is claimed.
Framework
AICPA Trust Services Criteria (2017, revised 2022)
TSC in scope
Security, Availability
Audit window
2026-04-01 → 2026-09-30
| Vendor | Purpose | Location | DPA |
|---|---|---|---|
| MongoDB Atlas | Primary database | US / EU (customer-selectable region) | On file |
| Cloudflare | Edge / TLS termination / CDN / WAF | Global anycast | On file |
| Stripe | Payment processing | US (Ireland for EU) | On file |
| Resend | Transactional email | US | On file |
| Anthropic | LLM (Canaan chat + causal engine) | US | On file |
| OpenAI | LLM (optional fallback path) | US | On file |
| Google Cloud | Search Console indexing API | US | On file |
The evidence pack is available to logged-in customers and prospects. Sign in to download; a Type II report will be released after the audit window closes.
Every query DuluthPath runs against your systems is logged with the proof that 0 records were stored. Available inside your account at /settings/integrations.
// Sample log entry
org_id: ORG-4821
system: SAP S/4HANA
query_type: aggregate (fill_rate_30d)
records_queried: 847
records_stored: 0 ✓
timestamp: 2026-05-12 14:32:01Z
Our security team will walk your team through architecture, threat model, encryption posture, and provide pre-filled vendor questionnaires. 30-min session, no slides.