Data Processing

For data you entrust to us, you are the controller and we are the processor. We act on your documented instructions and tell you if an instruction looks like it breaches applicable law.

We do not train models on client data, and we select providers whose API terms commit to the same in writing.

Where a workload cannot tolerate third-party processing, we deploy inside your own cloud account or on-premise.

Hosting, model inference and monitoring, each under written terms no less protective than ours. We keep a current list, give advance notice of changes, and you may object.

Encryption in transit and at rest. Least-privilege access, reviewed. Audit logging of what was sent to a model and when. Separation between client environments. Documented incident response with notification without undue delay.

We keep client data only as long as the engagement needs it. At the end we delete or return it at your choice within 30 days, except where law requires a copy.

We give you what you reasonably need to demonstrate compliance, and assist with data subject requests, impact assessments and breach notification for the processing we do for you.