Security & data
Built for procurement teams who need evidence, not hype.
ProcureAI by Stellitron shows its work: rules-first agents, logged steps, and human approval gates. This page explains what we store in the public trial and what we configure with you in a pilot — without claiming certifications we have not earned.
How decisions are made
ProcureAI agents run deterministic rules first — tolerances, policy gates, duplicate checks, and playbook clauses — before anything is approved or posted.
Every agent run writes a step-by-step trace with the evidence it used: PO line prices, contract section IDs, supplier scores, and the exception that triggered a hold.
People stay in control. Routing, releases, awards, and payments require explicit approval in the workflow; the agents prepare the packet, not the final signature.
Your data in the document trial
The public trial is for dummy or anonymized documents only — sample invoices, contracts, purchase requests, or supplier profiles you are comfortable testing with.
When you register we store your name, email, company, the document text you submit, and the agent results in a managed Postgres database. We use that to run the trial, improve the product, and follow up if you ask for a demo.
Request deletion at any time: email contact@stellitron.com from the address you used to register and we will remove your trial record.
Data in a pilot or production
Enterprise pilots are scoped with your security and procurement teams. Typical options we configure together — not blanket claims for every deployment:
- Run ProcureAI in your cloud account or VPC so documents and master data stay in infrastructure you control.
- Sign in through your identity provider (SAML/OIDC SSO) and map roles to who can run agents, approve exceptions, or export audit data.
- Keep data in your chosen region and set retention windows that match your records policy.
- Execute a data processing agreement (DPA) when your legal team requires one — available for pilots and enterprise agreements.
AI model governance
Stellitron Intelligence uses AI providers whose API terms state that submitted content is not used to train their models.
Optional model calls enrich extraction or drafted emails; the rules path still runs if AI is off or unavailable.
Your security team receives provider names, data flows, and subprocessors during the pilot so you can complete your vendor review.
Access & audit
The public demo uses synthetic data and is open to everyone. In pilot tenants, role-based access limits who can view suppliers, contracts, invoices, and agent traces.
The activity log records agent runs, approvals, and status changes with timestamps and links back to the underlying document.
In pilots, the audit trail can be exported for internal controls or an external review.
Integrations
ProcureAI is built to sit alongside systems you already run: SAP S/4HANA, Oracle, NetSuite, Coupa, DocuSign, and email or SFTP document intake.
Connectors are built during pilots to match your interfaces, master data, and approval hierarchy — they are not sold as a fixed catalog of off-the-shelf plugins.
We document what syncs, how often, and what stays read-only until your team signs off.
Questions
Is ProcureAI SOC 2 certified or GDPR compliant?
Not yet. No independent audit has been completed, and SOC 2 Type I is in preparation. Our Trust center lists the controls in place today, with live checks you can verify yourself.
Where does my trial document go?
Document text and agent output are stored in managed Postgres used only to operate the trial. Use dummy data; do not upload live employee, patient, or cardholder records.
Can we keep all data inside our cloud?
Yes — that is a common pilot setup. We deploy into your account or a dedicated environment you own, with networking and secrets under your policies.
Who can see agent traces and approvals?
Only users with roles you assign. The demo uses synthetic data; pilots mirror your org chart through SSO groups or role mappings you approve.
How do we start a security review?
Request a demo and note you need a security packet. We walk through architecture, data flows, AI providers, and integration scope on a call, then share written materials for your reviewers.
Talk through security on a live demo
We will show the agents on your processes and answer questions about data residency, SSO, audit export, and pilot scope.