Security & privacy
The biggest reason established businesses hold back on AI isn't capability — it's control. Where does the data go? Who can see it? What can the AI do on its own? Here's exactly how we keep you in control of all three.
The principle
Our whole approach is built on one idea: the level of automation should match the risk. Sensitive or high-impact actions always require named human approval. Bounded low-risk actions may run automatically only when the client has explicitly approved the rule, the workflow is tested and logged, and the action is reversible.
How we protect your data
Security isn't one setting — it's where the data lives, who can reach it, and what's allowed to happen to it.
OpenAI and Anthropic state that their official commercial, business, enterprise, and API offerings do not use customer inputs or outputs for model training by default. Settings, feedback or opt-in programs, and contracts can change that treatment, so we verify the selected product. Provider policies last reviewed August 1, 2026.
We configure roles, permissions, and connection limits so the AI only reaches the data it should, and only the right people can use it. Least access by default.
We define which events must be logged — including relevant inputs, drafts, decisions, approvals, and system changes — then test that the configured record is available for review.
Where your AI runs
The right setup depends on how sensitive your data is and what your rules require.
Claude or OpenAI on an official commercial offering can be fast to deploy. Business data is excluded from model training by default, subject to the chosen product settings, feedback or opt-in programs, and governing contract.
A self-hosted deployment can keep data within the configured environment only when the full system — model, connectors, logging, telemetry, and backups — is scoped and tested that way.
Hosted for general work, private for the sensitive data and high-volume tasks. We help you draw the line in the right place.
Clear lines
Trust is easier when the limits are explicit. These are ours.
We confirm the selected provider product, settings, feedback choices, and contract instead of treating a vendor-wide slogan as a control.
The AI never sends money, deletes records, or makes commitments on its own. Those always require a human to approve.
We connect the AI to what it needs for the task and nothing more, and we keep data only where your policies allow.
Want your team using AI confidently inside these guardrails — in a configured workspace or private deployment your company controls? That is exactly what the platform setup levels cover.
See Platform SetupCommon questions
Official OpenAI and Anthropic commercial, business, enterprise, and API products do not use customer inputs or outputs for model training by default. Product settings, feedback or opt-in programs, and the governing contract can change that treatment, so we verify the selected product and settings before implementation.
Sensitive or high-impact actions always require named human approval. Bounded low-risk actions may run automatically only after they are explicitly approved, tested, logged, and made reversible.
A self-hosted deployment can keep data within a configured network or private cloud only when the full deployment — including connectors, logging, telemetry, and backups — is scoped that way. We document and test those boundaries; the model alone does not guarantee them.
The client controls the configured workspace, roles, permissions, and connection limits. We scope which people and systems can reach each data source and which configured events are logged.
We build to support your data-residency, access-control, and audit requirements, and we work within your existing policies. We are not a substitute for your compliance team — we give them controls and records to work with.
Adopt AI with confidence