Security & Trust
Your data is not our product. It's your business.
When you bring us into your systems and data, you're extending significant trust. Here's how we earn and protect it.
Principles
Our approach to data security
Encryption at rest and in transit
All client data is encrypted using industry-standard protocols both while stored and while moving between systems.
Least-privilege access
We request only the minimum permissions required for each specific integration. If we don't need write access, we don't ask for it.
No data resale or sharing
Client data is never sold, shared with third parties, or used to train models. Your data stays yours.
Access controls per engagement
Access is scoped to the engagement and revoked upon completion unless ongoing support is in place.
Documented data handling
Before accessing any client system, we document exactly what data we'll touch, why, and how it'll be protected.
Self-Hosted Option
Cloud isn't the only path.
For businesses with compliance requirements, data residency concerns, or a preference to keep operations fully in-house, we offer on-prem and self-hosted AI deployment. Your AI runs inside your own infrastructure — no data leaves your environment.
This is especially relevant for businesses in healthcare support, legal services, or financial services where data handling standards are strict. We assess fit during the discovery process — we won't recommend self-hosted if the complexity outweighs the benefit.
Self-hosted deployment means:
AI models run on your own servers or private cloud
No data transmitted to external AI providers
Full audit trail under your control
Compliance documentation you actually own
Configurable access by role and department
Data Ownership
Your data belongs to you.
Every dataset, pipeline, dashboard, and model we build during an engagement belongs to you — not to us. We don't retain access to client data after an engagement ends unless there's an active support agreement in place and you've explicitly authorized continued access.
This extends to model outputs and derived data. If we fine-tune a model using your business data, the resulting model weights are yours. We will never use client data to improve our tooling or models without your explicit, written consent.
Compliance Readiness
Where we stand on certifications
We want to be honest about this. As a growing practice, we do not currently hold formal certifications such as SOC 2 Type II or HIPAA Business Associate status.
What we do have: documented data handling procedures, clear contractual data ownership terms, and a track record of engaging only with the systems and data required for each specific implementation.
If your business operates in a regulated industry with specific compliance requirements, raise this early in the discovery call. We'll be transparent about whether we're the right fit, or whether you need a partner with formal certification first.
Have security questions?
Ask us directly. We'll answer plainly.