Quantified is built for regulated environments, not adapted from horizontal AI. Our security program is independently audited under SOC 2 Type 2, your data is hosted in the US or the EU, and AI models never train on your data. Everything here is documented for your InfoSec, privacy, and AI governance review.
It is when the vendor can prove it. Here is what to ask for, and what Quantified provides.
AI roleplay is secure enough for enterprise pharma when the vendor can show independent evidence: a SOC 2 Type 2 report, a documented commitment that your data never trains AI models, hosting in your region, encryption at rest and in transit, SSO with role-based access, and a defined deletion policy. Quantified provides each of these, with the documentation to verify them under NDA.
The platform was built for life sciences commercial teams from the start. Simulations run on fictional HCP personas and your MLR-approved content, so no patient data is needed. Speech is transcribed in real time, and raw audio and video of your users are not retained.
Every control on this page maps to a document your reviewers can request. The SOC 2 Type 2 report and penetration test report are shared under NDA.
| Control Area | What Quantified Does | How You Verify It |
|---|---|---|
| AssuranceIndependent audit | SOC 2 Type 2 examination by an independent auditor against the Security trust services criteria, covering the AI Roleplay and Sales Coaching platform. Most recent report period ended December 2025; the next annual audit is underway. | SOC 2 Type 2 report · NDA |
| AssurancePenetration testing | Annual third-party penetration test, plus continuous vulnerability scanning of code, dependencies, and infrastructure. Controls are monitored continuously in a compliance automation platform. | Penetration test report · NDA |
| AIModel training | Quantified does not train or fine-tune models on customer data. Commercially licensed foundation models are accessed through enterprise inference endpoints, and providers are contractually prohibited from training on inputs. | AI Model Card |
| AIAI governance | A documented AI Governance and Risk Management Policy, AI transparency documentation, and an EU AI Act assessment. Users are always told they are interacting with AI. | AI governance documentation |
| DataHosting and residency | AWS in US East (Ohio) or Europe (Frankfurt), in separate, logically isolated regions. EU customers are provisioned in Frankfurt. Each customer has a logically isolated tenant. | Security questionnaire |
| DataEncryption | AES-256 at rest through AWS KMS, with keys rotated at least every 12 months, across databases, storage, backups, replicas, and snapshots. TLS for all data in transit. Secrets held in AWS Secrets Manager. | Security questionnaire |
| DataRetention and deletion | Data is retained for the contract term, with custom retention periods available. After account closure, the account is held in an expired state for 90 days and then permanently deleted, unless law requires otherwise. | Your agreement and DPA |
| DataSubprocessors | A maintained subprocessor registry under a documented Vendor Management Policy. Our speech-to-text provider operates under zero data retention and is opted out of model improvement. | Subprocessor list |
| AccessIdentity and roles | SSO through SAML or OIDC. Role-based access for learners, team managers, and enablement administrators, with manager visibility configurable to cohort, individual, or both. | Shown in your demo |
| AccessInternal access | Least-privilege access, with production limited to the Operations team. MFA enforced on cloud and workspace admin accounts, and privileged access reviewed every quarter. | SOC 2 Type 2 report · NDA |
| ContentMLR governance | Scenarios are built from content your MLR team has already approved, every session is scored against your MLR-cleared claims, and off-label language is flagged. Each session’s record includes the transcript, the scores against your criteria, and a timestamp. | Shown in your demo |
| ResilienceBackup and recovery | Daily backups with point-in-time recovery, zone-redundant production databases with a recovery region, and a documented disaster recovery and business continuity plan with tested restoration. | Security questionnaire |
AI governance reviews ask how the model works, what it learns from, and who can see the output. These are our answers, in writing.
Customer data is never used to train, fine-tune, improve, or benchmark shared models. Foundation models are accessed through enterprise inference endpoints, and every provider is contractually prohibited from training on your inputs.
Behavior changes only when your team changes the scenarios, criteria, or approved content behind them.
If you ever want a model tuned to your program, it runs on a dedicated model, under a written agreement, and only if you opt in.
Fixed rules govern the experience, and generative AI handles specific jobs using your approved content only.
Users are informed they are interacting with AI, and avatars are fictional personas, never modeled on your people.
The fastest security review is the one with the least sensitive data in scope. AI Roleplay was designed to keep that footprint small.
Speech is transcribed in real time, and only the text transcript is stored for scoring and review.
The platform performs no biometric identification and creates no voiceprints.
Simulations run on fictional HCP personas and your approved content. No PHI is retained.
Avatars are fictional personas licensed from consenting professional actors, never derived from users.
We process profile, usage, transcript, and evaluation data to run the platform, and nothing from your HR systems.
Quantified is delivered as SaaS. No VPN or network connection into your environment is required.
Choose US or EU hosting. Either way, your tenant is logically isolated, encrypted at rest and in transit, and deleted on a defined schedule.
Who can reach your data, how code reaches production, and what happens if something goes wrong.
The standards behind our program, and a clear statement of scope so your team can close review items quickly.
Annual examination by an independent auditor against the Security trust services criteria. Report available under NDA.
Aligned with applicable privacy laws, including GDPR. Quantified acts as a data processor, with EU hosting in Frankfurt and Standard Contractual Clauses for international transfers.
Records of Processing Activities under GDPR Article 30. Quantified supports customers’ DPIAs with the documentation they need.
A documented assessment places the platform in the limited-risk category, with transparency obligations met by telling users they are interacting with AI.
Non-clinical by design. Quantified is a sales training and coaching platform. It does not touch clinical systems or patient records, so GxP validation and 21 CFR Part 11 are out of scope.
Built on audited infrastructure. The platform runs on AWS, which maintains its own independent attestations for the physical and infrastructure layers beneath our controls.
Regulated buyers run thorough reviews. We bring the documents up front so your InfoSec, privacy, and procurement teams aren’t waiting on us.
Sign a mutual NDA and receive the SOC 2 Type 2 report, penetration test report, and AI governance documentation.
Our security team completes your standard vendor security and AI risk questionnaires.
Your privacy and legal teams review the Data Processing Agreement, subprocessor list, and hosting region.
Connect your identity provider and set who sees what before the first rep signs in.
Shared directly with your review team, as files, never as public links.
Answers for InfoSec, privacy, procurement, and AI governance teams evaluating Quantified.
Yes, when the vendor can show independent evidence. Look for a SOC 2 Type 2 report from an independent auditor, a documented commitment that your data never trains AI models, hosting in your region, encryption at rest and in transit, SSO with role-based access, and a defined deletion policy. Quantified provides each of these and shares its SOC 2 Type 2 report and latest penetration test report under NDA.
Yes. Quantified completed a SOC 2 Type 2 examination by an independent auditor against the Security trust services criteria, covering the AI Roleplay and Sales Coaching platform. The most recent report period ended December 2025, and the next annual audit is underway. SOC 2 is an attestation report, not a certification, so we share the full report under NDA for your team to review the scope and results directly.
No. Quantified does not train or fine-tune models, and customer data is never used to train, fine-tune, improve, or benchmark shared models. We access commercially licensed foundation models through enterprise inference endpoints, and providers are contractually prohibited from training on your inputs. The platform does not learn continuously from sessions. Any customer-specific training would be opt-in only, under a written agreement, on a dedicated model.
On AWS, in the region you choose: US East (Ohio) or Europe (Frankfurt). The two regions are separate and logically isolated, EU customers are provisioned in Frankfurt, and every customer has a logically isolated tenant.
Data at rest is encrypted with AES-256 through AWS KMS across databases, storage, backups, replicas, and snapshots, with keys rotated at least every 12 months. Data in transit is protected with TLS, and application secrets are held in AWS Secrets Manager.
No. During AI Roleplay sessions, speech is transcribed in real time and only the text transcript is stored for scoring and review. Raw audio and video of users are not retained, the platform creates no voiceprints, and it performs no biometric identification. Avatars are fictional personas licensed from consenting professional actors.
No. Simulations run on fictional HCP personas and your MLR-approved content, so no patient data is needed and no PHI is retained. In Field AI, personal and health information is removed from call notes before they sync to your CRM.
For the term of your agreement, with custom retention periods available. After account closure, your account is held in an expired state for 90 days and then permanently deleted, unless law requires otherwise.
Quantified supports SSO through SAML or OIDC with identity providers such as Okta, typically configured in about a week. Access is role-based across learners, team managers, and enablement administrators, and manager visibility is configurable: cohort, individual, or both, the customer’s choice. User provisioning is managed with our team during rollout.
Quantified is aligned with applicable privacy laws, including GDPR. We act as a data processor, maintain Records of Processing Activities under Article 30, support customers’ Data Protection Impact Assessments with the documentation they need, use Standard Contractual Clauses for international transfers, and host EU customers in Frankfurt.
A documented EU AI Act assessment places the platform in the limited-risk category. Users are told they are interacting with AI, and our AI Model Card, AI transparency documentation, and AI Governance and Risk Management Policy are available for your review.
No. Quantified is a non-clinical sales training and coaching platform that does not touch clinical systems or patient records, so GxP validation and 21 CFR Part 11 are out of scope for the platform.
Request the security package. After a mutual NDA, we share the SOC 2 Type 2 report, the latest penetration test report, and our AI governance documentation as files, and our security team completes your vendor security questionnaire. Request the security package.
Quantified is the AI Roleplay and Sales Coaching Platform for life sciences and regulated commercial teams. Quantified is used by 55,000+ field reps at 30+ enterprise customers, including more than 10 of the top global pharmaceutical companies.
Request the security package, and we’ll walk your InfoSec and AI governance teams through every control on this page.
