Most data policies describe what a company does with data it has collected. This one has to start somewhere else, because the product is deployed inside your own environment and in that mode there is no collection to describe. The software runs where your data already is. Nothing is sent to us, nothing checks in, and nothing stops working if we disappear.
That is an architectural property rather than a promise, which matters: a commitment can be broken, and a system with no outbound route cannot be. It also changes the legal analysis rather than merely softening it, and the three modes below are separated because they genuinely differ in law.
Almost every question a security review asks is answered by working out which of these you are in. Most engagements are Mode A, and Mode A is the one with nothing in it.
MODE A
The product, running in your environment.
MODE B
You ask us to run an assessment and the data is permitted to move.
MODE C
You send a message through a form or by email.
The software is installed and operated by you, on your infrastructure or in your own cloud tenancy. Model weights, training data, telemetry, records and logs are created in your environment and stay there. There is no hosted tier, no usage meter, no licence server, no crash reporter and no update check.
None by default. Where a support engagement requires us to see something, you decide what to share, you share it deliberately, and that transfer is Mode B with Mode B's terms. We do not hold standing credentials to any customer environment.
You remain the controller. A processor is a party that processes personal data on behalf of a controller; where we do not receive, store, transmit or access the data, no such processing occurs and no Article 28 relationship arises in respect of it. A DPA remains available and is required the moment any evaluation moves data to us.
A business associate is an entity that creates, receives, maintains or transmits protected health information on behalf of a covered entity. In Mode A we do none of those four things, so the relationship does not arise and no BAA is required. Where an evaluation involves PHI, we execute one first.
What we ask for
A model checkpoint, read-only, and a sample of labelled data that you select. Source or site columns if your data carries them and you choose to include them.
What we never ask for
Credentials, API keys, production access, employee personal data, or any data beyond what the specific diagnostic question requires. If a request looks broader than the question, refuse it and tell us.
In transit and at rest
TLS 1.3 in transit. AES-256 at rest. Region agreed with you in writing before transfer, and EU-resident by default for EU customers.
Who can access it
Only the people running your assessment, named to you before the engagement begins. No general access, no analytics, no internal sharing.
Retention
Deleted within 30 days of the report being delivered, or immediately on your written request at any point before that.
Certification of deletion
Issued in writing on request, naming what was deleted, from which locations, by what method, and on what date.
What we keep afterwards
The report itself, and correspondence about the engagement. Nothing else. Aggregate findings are kept only in a form that identifies no organisation, model or dataset.
Breach notification
Without undue delay and within 72 hours of becoming aware, to you directly, with what is known and what is not yet known stated separately.
No evaluation involving personal data or regulated data begins without a signed Data Processing Agreement. We do not start work and then paper it afterwards.
Train any model on your data, including our own.
Transfer, sell, license or share your data with a third party for any commercial purpose.
Publish a result that identifies your organisation, your model or your dataset without your written permission.
Retain a model checkpoint, a dataset or a run log beyond the window stated below.
Require any connection outward from your network in order for the software to run.
The last one is the load-bearing commitment. Everything above it is a policy; that one is enforced by the software having no outbound route to begin with.
In Mode A no PHI is created, received, maintained or transmitted by us, so no business associate relationship arises and no BAA is required — the four verbs in the definition are the whole test, and none of them applies. Where an evaluation involves PHI, we execute a BAA before any transfer and we would expect your data use agreement and any relevant ethics approval to govern the sample you send.
Position, client and transaction data does not move, which is the default assumption for this sector rather than a concession to it. For third-party risk assessment: we are a software supplier rather than a service provider in Mode A, there is no outbound connectivity to review, and no data residency question arises because there is no transfer.
The software operates in air-gapped and network-isolated environments without modification, because nothing in it requires a connection. We hold no clearance and expect none, and export-control classification of anything we supply is confirmed in writing before delivery rather than assumed.
Each participating site holds its own data and its own record. Nothing central is required for the architecture to work, and no participant sees another participant's data through us because no route exists for that.
No sub-processor touches anything in Mode A, because nothing reaches us. This list covers the website and any evaluation you commission.
Form relay
Email and correspondence
Website hosting
Evaluation compute
Listed so you do not have to ask, and so a security review does not discover an absence halfway through.
In Mode A, where it already is. We do not store it, so there is no region to choose and no residency question to answer. In Mode B the region is agreed with you in writing before any transfer, and defaults to the EU for EU customers.
Yes, without modification. Nothing in it requires a connection: no licence check, no update check, no telemetry, no crash reporting. That is a design constraint taken from the environments this is built for, not a configuration option that could be switched the other way.
For Mode A, not for the data the software handles, because no processing occurs on our behalf. Many organisations execute one regardless as a matter of policy and we are happy to sign. For Mode B it is mandatory and precedes any transfer. A template is available on request before you commit to anything.
No, in any mode, under any circumstance, including for our own research. If we want to publish something learned from an engagement, we ask, we show you the exact wording, and we accept no as an answer.
By assessing what actually applies. A SOC 2 report attests to controls over data a vendor holds, and in Mode A we hold none — the review question becomes software supply chain rather than data custody. We provide reproducible hash-pinned builds so you can verify the binary you run, and the licence carries a reproducible build attestation. For Mode B, SOC 2 is a fair thing to want and we do not have it.
In Mode A there is nothing to compel: we cannot produce what we do not hold. In Mode B, where lawfully permitted, we notify you before responding to any legal demand and give you the opportunity to challenge it. Where we are prohibited from notifying you, we challenge that prohibition.
Mode B material is deleted on the schedule above and certified on request. Records the software generated in your own environment are yours and were always yours — the licence carries a perpetual right to read and reproduce them, plus a frozen reader binary you keep, precisely so that ending the relationship does not endanger your own audit trail.
Data enquiries are answered within five working days. A deletion request is acted on immediately and confirmed in writing.
Data protection requests have their own route on the contact form. It reaches the founder directly rather than a shared inbox, a ticketing system or a privacy team that does not exist.
What this page does not cover
The commercial terms of an engagement, which are in the licence and the engagement contract. Your own obligations as controller of the data the software processes in your environment, which remain yours throughout.
This site sets no cookies and runs no analytics. The contact form holds a submitting IP address for up to ten minutes purely to limit abusive volume, unlinked to identity and never stored alongside message content.
This policy states the position we hold ourselves to. It is under review by a qualified data protection solicitor, and the entity registration referenced above is in progress.