Security and data protection
For banks, pharmaceutical firms and manufacturers, the question isn’t what AI can do. It’s where the data lives, who can access it and who is accountable for decisions. Below we explain how we build solutions to meet your security requirements, and what we agree in writing at the start of a project.
Where your data lives: deployment options
An AI solution can be deployed within your own infrastructure: inside your environment, on your hardware, on-premise. In that set-up, data never leaves for an external cloud, and processing takes place where you are in control.
We choose the deployment model to suit your case: entirely within your environment, in your private cloud, or a hybrid of the two. The boundary that data never crosses is defined and documented at the start of the project, so your security team can review it before a single line of code is written.
Which models we use
We choose the model to suit the task, not the other way round. For sensitive data, we use open-source models that run locally on your hardware, with no requests passed to external services. Where appropriate, we can also use external models, but that is always a separate decision agreed with you.
We don’t tie you to a particular supplier or default to one. Choosing the model is part of the project, not a fixed toolkit inherited from the previous client.
Access and encryption
Access to the system and the data is role-based: everyone sees only what they need for their job. Actions on data are logged, leaving a clear audit trail of who did what and when. Data is protected in transit and at rest.
We agree the specific security controls with your security team, to suit your infrastructure and policies. Rather than imposing our own standard on top of yours, we fit into what already works for your organisation.
GDPR and legal terms
We design solutions to comply with GDPR requirements: data minimisation, a defined lawful basis for processing, and the ability to erase data. On request, we sign an NDA and data processing terms that set out what is processed and how.
This reflects our willingness to work by your rules; it isn’t a substitute for your own legal assessment. The final decision on compliance always rests with your lawyers and security team.
Human in the loop, and what happens if the agent gets it wrong
We never hand critical decisions over to an agent entirely. Where a mistake would be costly, a person stays in the loop: the agent prepares an option and a person signs it off. For each scenario, we decide in advance what the agent handles on its own and what it refers for approval.
If the agent is uncertain or goes beyond what it is permitted to do, it stops and passes the case to a person rather than guessing. The agent’s permissions and the escalation procedure are set out before launch, so you know in advance how the system will behave in a disputed case, rather than finding out in production.
Computer vision and privacy
Our computer vision is adapted to EU law. We don’t collect faces or build personal data about people. The system works with commercial metrics: shelf availability, merchandising and sales on the shop floor.
In other words, you get analytics on products and space, not surveillance of shoppers. For retailers, this removes a whole category of legal risk at the level of what the camera records in the first place.
Support and SLA
Support and response terms are set out in the contract: what support covers, response times and how updates are handled. Support starts from $150 a month, with the scope depending on the complexity of the solution. We have already delivered large projects with heightened security requirements, so we are ready to follow your procedures rather than impose our own.
FAQ
Frequently asked questions
Can we deploy the solution entirely within our own infrastructure?
Yes. The solution can be deployed on-premise, inside your environment, on your hardware, with no data leaving for an external cloud.
Is our data passed to external cloud services?
Not with local models. The boundary that data never crosses is agreed and documented at the start of the project.
Which models are used for sensitive data?
Open-source models that run locally on your hardware. External models are used only if separately agreed with you.
Do you sign an NDA?
Yes. On request, we sign an NDA and data processing terms that set out what is processed and how.
Who is responsible if the agent makes a mistake?
A person signs off critical decisions. The agent’s permissions and the escalation procedure are set out before launch, so the system doesn’t guess in disputed cases.
Does your computer vision capture people’s faces?
No. We work with merchandising, shelves and shop-floor sales, without faces or personal data about people.
Free consultation
See how it would work inside your environment
Book a free consultation. We’ll go through your infrastructure, security requirements and deployment options, so you can see the data boundary and how the solution will operate before the project begins.
What you'll get from the consultation