SECURITY & DATA HANDLING
Your data is the asset. We treat it that way.
We're a small firm, so we won't show you a wall of badges. We'll show you the architecture instead, and answer any question your IT team asks, in writing.
01
Your data stays in your house.
Wherever possible, systems run inside your Microsoft 365 or cloud tenant, or on hardware you own. We build in your environment, not ours.
02
Least-privilege, scoped, revocable.
Connectors get read access to exactly the systems a workflow needs, nothing else. You can see the scope list and revoke it at any time.
03
Your data trains nothing.
Client data is never used to train models, ours or anyone's. Model providers we route to are configured for zero retention where the provider supports it.
04
Humans approve, systems record.
Every consequential action an AI employee takes requires human approval and lands in an audit trail you own.
05
Export-anytime, by design.
Vector stores, knowledge graphs, skills, and code live in your repositories in open formats from day one. Firing us is a permissions change, not a migration project.
WHERE YOUR DATA LIVES
IN YOUR TENANT
Documents, mailboxes, chat history, and the knowledge systems we build from them.
IN TRANSIT, ENCRYPTED
Calls to model APIs when a task routes to a frontier model, under the retention terms above. TLS everywhere.
ON YOUR HARDWARE
For local deployments: models, weights, and inference logs never leave the building.
PLAIN ANSWERS
What buyers ask before kickoff.
Paperwork
We sign your NDA and DPA, and we'll complete your security questionnaire.
Subprocessors
Disclosed in writing before the engagement starts, updated if they change.
Certifications
Not yet — and we won't dodge that. What we hand you instead is a diligence pack built for your review process: our controls mapped to the questions standard security questionnaires ask, subprocessors named with their retention terms, and every exit path documented. The pack index is public, with an honest status on each artifact. If your procurement requires SOC 2 specifically, tell us early — we'll say plainly whether that rules us out, and save everyone the cycle.SEE THE DILIGENCE PACK >
Incidents
A named contact, a notification commitment in your contract, and a written post-incident report.