Answers to the questions your IT and legal teams will ask.
AI projects raise legitimate questions about data, access and control. Here is how we handle them on every project.
Where does our data go?Only where you approve, and every flow is documented.
For each project, we document every data flow: what is sent, where, to which model provider, and how long it is kept. You approve this map before anything goes into production. When external models are used, we select offers that do not use your data to train their models, and we state it in writing.
Who has access to it?Only the named members of the project team.
Access is limited to the people working on the project, with individual accounts and the minimum rights needed. Where possible, accounts are managed through your own identity provider. Access is removed at the end of the engagement.
Can everything be hosted on our side?Yes. In your cloud or on your own infrastructure.
We can deploy in your own cloud tenant or on your servers. When external AI services are not acceptable, we can use open-source models deployed in your environment. Connections, telemetry and third-party services are checked against the agreed data boundaries.
Can we trace what AI agents do?Logging and auditing are adapted to agent actions, connected systems and your security requirements.
We agree which actions to log, the level of detail and retention periods. Depending on connected systems, logs can include the input, the decision, the system called, the result and any required approval. Logs can be sent to your monitoring and security tools.
How is confidentiality guaranteed?A non-disclosure agreement, signed systematically.
We sign a non-disclosure agreement before any exchange of sensitive information. Every member of the project team, including engineers from our network, is bound by the same obligations.
Who keeps control of decisions?Your teams. Sensitive actions require a human validation.
You decide which actions an agent can take on its own and which require validation. Commitments with financial, legal or customer impact stay with your teams. Validation rules are part of the specification and can be adjusted at any time.
What about data protection rules?GDPR, APPI and PDPO are taken into account from the design stage.
We design systems with the applicable data protection rules in mind: the GDPR in the European Union, the APPI in Japan and the PDPO in Hong Kong and applicable US privacy laws, including California’s CCPA as amended by the CPRA. In the US, HIPAA for covered health information and GLBA for covered financial activities are assessed where applicable. We work with your data protection officer and legal teams on processing agreements, retention periods and cross-border transfers. We do not claim any certification: we adapt to your own security and compliance requirements, and to your audits.
Bring your security team to the first meeting.
We prefer to answer their questions early. It saves time for everyone.