Your data stays yours.
Using AI should never mean giving up control of your information. Privacy and security are part of the foundation we build, not a checkbox we add later. Below is exactly how we protect your data and who touches it.
Trust is not a certificate on the wall. It is the way we build.
We do not have a SOC 2 report yet. What we have is a rigorous, transparent security practice baked into every system we deliver. Our clients are established businesses that deserve the same depth the Fortune 500 demands — so we engineer for that standard from day one, and we document every decision along the way.
What we protect, and how.
Six principles that shape every system we build.
Ownership and confidentiality
Your data is yours. Everything you share is treated as confidential from the first conversation. We work under your terms, and we will sign a specific NDA whenever you prefer one.
Least-privilege access
Agents and systems see only the data they need to do their job. Sensitive fields are masked or kept in your environment, and access is scoped deliberately rather than granted wholesale.
Governance and traceability
Every system ships with a trace behind its decisions. You can see what an agent did and why — data that can stand up to a customer, a regulator, or your board.
Retention and model use
We are deliberate about what data leaves your walls, where it goes, and what is retained. We do not quietly repurpose your information, and we configure providers so your data is not used to train their models.
Infrastructure isolation
Each client environment is logically separated. We do not commingle data in shared databases or vector stores. Where possible, sensitive data stays inside your cloud account and under your policies.
Incident readiness
We maintain an incident response playbook. If something goes wrong, we isolate, notify, and remediate within hours — not weeks. You get a full post-incident report with concrete steps taken.
Specific practices, not vague promises.
These are the concrete controls that run underneath every system we ship. No jargon, no hand-waving.
Encryption everywhere
Data is encrypted in transit (TLS 1.3) and at rest (AES-256). API keys and credentials are never stored in code repositories; they are injected at runtime via secure secret management.
Environment isolation
Each client gets logically separated environments. We do not commingle data across clients in shared databases or vector stores. Production and staging are strictly separated.
No training on your data
We configure every provider — OpenAI, Anthropic, and others — to opt out of model training. Your conversations and documents are processed for inference only and are not used to improve third-party models.
Audit logging
Every agent action is logged with timestamps, inputs, and outputs. You can review what happened, when, and why. Logs are retained according to your policy, not ours.
Who touches your data, and why.
We use a small, vetted set of infrastructure and AI providers. Each has a data processing agreement or enterprise terms in place.
OpenAI / Anthropic
LLM inferenceEnterprise agreements with zero-retention and no-training flags enabled.
Cloud infrastructure
Compute and storageMajor cloud providers with ISO 27001 and SOC 2 compliant infrastructure.
Vector databases
Retrieval-augmented generationSelf-hosted or isolated tenant instances. No cross-client access.
Questions we expect you to ask.
Where is my data stored?+
In your preferred region, typically North America. We use cloud infrastructure with AES-256 encryption at rest and TLS 1.3 in transit. Sensitive data can be kept entirely within your environment if required.
Can my data be used to train AI models?+
No. We explicitly opt out of model training with every provider we use. Your data is processed for inference only and is not retained by providers for model improvement.
What happens if there is a breach?+
We have an incident response playbook. You would be notified within 24 hours, we would isolate affected systems immediately, and we would provide a full post-incident report with remediation steps.
Can we run a security review or pen test?+
Yes. We welcome client security reviews and can provide architecture diagrams, data flow documentation, and access to our internal control matrix under NDA.
Questions about how we handle data?
Ask us directly. We would rather over-explain than leave you guessing.