Security
Your data stays yours, and so does the model
In every contract
Four guarantees
You own the weights
Trained adapters and checkpoints are assigned to you in the contract. There's no licence fee to keep using them.
Your data trains only your model
We never reuse your data for other clients or for our own models.
Deployed where your data lives
Train and serve inside your cloud account or data centre, not ours.
Deleted when we're done
All copies we hold are deleted at project close, and we confirm the deletion in writing.
Controls
How we enforce them
Encryption everywhere
TLS 1.2+ in transit and AES-256 at rest, using keys you control.
Least-privilege access
Named engineers get time-boxed roles, and access is revoked at handover.
PII redaction
Personal data is detected and masked automatically before it reaches a training job.
Isolated environments
Each client gets separate compute, storage, and credentials. Nothing is shared.
Audit logs
Every data access and training run is logged and exportable to your SIEM.
Contract terms
NDA and data-processing agreement signed before any data is shared.
Data lifecycle
What happens to your data, from handoff to deletion
- 01
Ingest
Received through your chosen transfer method and checked against the agreed schema.
- 02
Prepare
De-duplication and quality filtering, with a report you can review.
- 03
Train
Used only in your isolated training environment, with every run logged.
- 04
Retain
Kept only as long as the statement of work says, and encrypted throughout.
- 05
Delete
Removed from every system we control, with a signed deletion certificate.
Compliance
Where our certifications stand
We show the real status of each certification. Nothing is marked certified until the report is issued.
- SOC 2 Type IIIn progress
- ISO/IEC 27001Planned
- GDPRIn progress
- India DPDP ActIn progress
FAQ
Security questions
Can you work in an air-gapped environment?
Yes. We ship container images and model weights on approved media and train on your hardware. The engineers work on site or through your bastion hosts.
Do you use third-party annotators?
Only with your written approval. By default, labelling is done by our own vetted staff or by reviewers you nominate.
How would you handle a security incident?
We would notify you within 24 hours of detection, contain the incident, and give you a written root-cause report. The detailed timelines are in your data-processing agreement.
Can we pen-test the deployed endpoint?
Please do. The endpoint runs in your environment, so your security team can test it on its usual schedule. We'll fix anything it finds.
Need our security questionnaire answered?
Send your vendor-assessment pack. We'll return it with supporting documentation.
We reply within one business day (IST).