Everything your security and procurement teams need to review Peak Amp.
How we host, protect and use your data, where we stand on compliance, and how to request our security documentation.
Current status.
Infrastructure and hosting
The Peak Amp platform is hosted on Amazon Web Services in the United States. Data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256. Each customer’s data is kept logically separate.
Access to your systems
Connections to your building automation, maintenance and other systems are read-only. Peak Amp reads data to analyze it; it cannot change setpoints, schedules, work orders or any other setting in your systems.
Access to your data
Customers access Peak Amp through individual user accounts with role-based permissions. Peak Amp staff access customer data only to deliver and support the service, including spot-checking findings for accuracy.
Data ownership
You own your data. We use it to deliver the service you contracted for, and we never sell it.
AI and model training
Peak Amp uses statistical baselines and anomaly detection to identify equipment drifting from normal, and large language models running on Amazon Bedrock within our AWS environment to summarize findings and draft recommendations. AWS does not use this data to train its own models.
We use de-identified, aggregated operational data to improve Peak Amp’s models, so patterns learned in one building help detect problems earlier in others. Customer, building and personal identifiers are removed before data is used for training. Your data is never shared with or identifiable to other customers, and customers can opt out of model training.
Personal information
Peak Amp works with equipment, maintenance, energy and invoice data. We do not handle patient, student or tenant records. The only personal information we hold is the names and work contact details of the people who receive findings and are assigned work.
Retention and deletion
When you leave, your data is returned or deleted within 30 days of your request. De-identified, aggregated data and the models trained on it are retained.
Our website
This website is hosted separately from the Peak Amp platform and does not store customer platform data. Information submitted through website forms and collected by Google Analytics is covered by our Privacy Policy.
Who processes data on our behalf.
Building, equipment and maintenance data is processed only by Amazon Web Services. The other services below handle contact details for customer users. We notify customers at least 10 business days before adding a subprocessor that processes customer data.
| Subprocessor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, storage and processing; AI through Amazon Bedrock; email through Amazon SES | United States (us-east-1) |
| Google Workspace | Email and documents for communicating with customer contacts | United States |
| HubSpot | Customer relationship management | United States |
| Slack | Internal team communication about customer accounts | United States |
| Calendly | Scheduling meetings with customer contacts | United States |
Available on request
- Architecture overview and data-flow diagram
- Completed security questionnaire
- Data processing agreement
- Certificates of insurance
- W-9 and company documentation
Our customer agreements are built on Common Paper’s standard Cloud Service Agreement and Data Processing Agreement, drafted by a committee of attorneys and widely used across the software industry, plus a short Data Use and AI Addendum.
Report a security concern
If you believe you have found a security issue affecting Peak Amp, email security@peakampintelligence.com. We will acknowledge your report promptly and keep you informed as we investigate.
Buying through procurement? We support security reviews and vendor onboarding from the first conversation, through a direct agreement or AWS Marketplace.