Data isolation
Each client's data is kept in separate environments and storage. We do not use your data to train shared or third-party models, and we choose providers whose terms support that.
- Separate environments per client
- Encryption in transit and at rest
- Data minimisation by default
Private deployment options
When policy requires it, systems can run inside your own cloud account or on infrastructure you control, including open-weight models hosted privately.
- Deploy in your cloud tenancy
- Self-hosted model options
- Network and region constraints respected
Permission-aware access
Assistants and search respect the permissions you already have. People only retrieve content they are entitled to see, and actions use least-privilege credentials.
- Inherit existing identity and roles
- Least-privilege service accounts
- Audit logs for access and actions
Model-neutral by design
We are not tied to any model vendor. We select models per use case based on quality, cost, latency and data-handling terms, and design systems so models can be swapped.
- Per-use-case model selection
- Abstraction layer for portability
- Regular re-evaluation as models change
How we work day to day
- Access to client systems granted per person, per project, and revoked at the end
- Secrets stored in managed vaults — never in code or chat
- Production data used only where needed; test data preferred
- Human review for high-impact automated actions
- Evaluation of AI outputs for accuracy, safety and leakage before launch
- Documented incident response and prompt notification
We align our practices with your security and compliance requirements. Formal certifications are not claimed here; we're happy to complete security questionnaires and work within your vendor-review process.
Have specific requirements?
Share your policies and constraints. We'll explain how we'd meet them — or tell you plainly if we can't.