Most data policies describe what a company does with data it has collected. This one has to start somewhere else, because the product is deployed inside the customer environment and in that mode there is no collection to describe. The software runs where the data already is. Nothing is sent to us, nothing checks in, and nothing stops working if we disappear.
That is an architectural property rather than a promise, which matters: a commitment can be broken, and a system with no outbound route cannot be. It also changes the legal analysis rather than merely softening it, and the three modes below are separated because they genuinely differ in law.
Almost every question a security review asks is answered by working out which of these three modes are in. Most engagements are Mode A, and Mode A is the one with nothing in it.
MODE A
The product, running in the customer environment.
MODE B
We are asked to run an assessment and the data is permitted to move.
MODE C
A message is sent through one of the forms.
The software is installed and operated by the licensee, on customer infrastructure or in their own cloud tenancy. Model weights, training data, telemetry, records and logs are created in the customer environment and stay there. There is no hosted tier, no usage meter, no licence server, no crash reporter and no update check.
None by default. Where a support engagement requires us to see something, the customer decides what to share, shares it deliberately, and that transfer is Mode B with Mode B's terms. We do not hold standing credentials to any customer environment.
The customer remains the controller. A processor is a party that processes personal data on behalf of a controller; where we do not receive, store, transmit or access the data, no such processing occurs and no Article 28 relationship arises in respect of it. A DPA remains available and is required the moment any evaluation moves data to us.
A business associate is an entity that creates, receives, maintains or transmits protected health information on behalf of a covered entity. In Mode A we do none of those four things, so the relationship does not arise and no BAA is required. Where an evaluation involves PHI, we execute one first.
What we ask for
A model checkpoint, read-only, and a sample of labelled data selected by the customer. Source or site columns if the data carries them and they are deliberately included.
What we never ask for
Credentials, API keys, production access, employee personal data, or any data beyond what the specific diagnostic question requires. If a request looks broader than the question, refuse it and tell us.
In transit and at rest
TLS 1.3 in transit. AES-256 at rest. Region agreed in writing before transfer, and EU-resident by default for EU customers.
Who can access it
Only the people running the assessment, named before the engagement begins. No general access, no analytics, no internal sharing.
Retention
Deleted within 30 days of the report being delivered, or immediately on written request at any point before that.
Certification of deletion
Issued in writing on request, naming what was deleted, from which locations, by what method, and on what date.
What we keep afterwards
The report itself, and correspondence about the engagement. Nothing else. Aggregate findings are kept only in a form that identifies no organisation, model or dataset.
Breach notification
Without undue delay and within 72 hours of becoming aware, direct to the customer, with what is known and what is not yet known stated separately.
No evaluation involving personal data or regulated data begins without a signed Data Processing Agreement. We do not start work and then paper it afterwards.
Train any model on the data, including our own.
Transfer, sell, license or share the data with a third party for any commercial purpose.
Publish a result that identifies the organisation, the model or the dataset without the organisation's written permission.
Retain a model checkpoint, a dataset or a run log beyond the window stated below.
Require any connection outward from the network in order for the software to run.
The last one is the load-bearing commitment. Everything above it is a policy; that one is enforced by the software having no outbound route to begin with.
In Mode A no PHI is created, received, maintained or transmitted by us, so no business associate relationship arises and no BAA is required. The four verbs in the definition are the whole test, and none of them applies. Where an evaluation involves PHI, we execute a BAA before any transfer and we would expect the data use agreement and any relevant ethics approval to govern the sample sent.
Position, client and transaction data does not move, which is the default assumption for this sector rather than a concession to it. For third-party risk assessment: we are a software supplier rather than a service provider in Mode A, there is no outbound connectivity to review, and no data residency question arises because there is no transfer.
The software operates in air-gapped and network-isolated environments without modification, because nothing in it requires a connection. We hold no clearance and expect none, and export-control classification of anything we supply is confirmed in writing before delivery rather than assumed.
Each participating site holds its own data and its own record. Nothing central is required for the architecture to work, and no participant sees another participant's data through us because no route exists for that.
No sub-processor touches anything in Mode A, because nothing reaches us. This list covers the website and any commissioned evaluation.
Form relay
Email and correspondence
Website hosting
Evaluation compute
Listed so nobody has to ask, and so a security review does not discover an absence halfway through.
In Mode A, where it already is. We do not store it, so there is no region to choose and no residency question to answer. In Mode B the region is agreed in writing before any transfer, and defaults to the EU for EU customers.
Yes, without modification. Nothing in it requires a connection: no licence check, no update check, no telemetry, no crash reporting. That is a design constraint taken from the environments this is built for, not a configuration option that could be switched the other way.
For Mode A, not for the data the software handles, because no processing occurs on our behalf. Many organisations execute one regardless as a matter of policy and we are happy to sign. For Mode B it is mandatory and precedes any transfer. A template is available on request, before any commitment.
No, in any mode, under any circumstance, including for our own research. If we want to publish something learned from an engagement, we ask, we show the exact wording, and we accept no as an answer.
By assessing what actually applies. A SOC 2 report attests to controls over data a vendor holds, and in Mode A we hold none — the review question becomes software supply chain rather than data custody. We provide reproducible hash-pinned builds, so the running binary can be verified independently, and the licence carries a reproducible build attestation. For Mode B, SOC 2 is a fair thing to want and we do not have it.
In Mode A there is nothing to compel: we cannot produce what we do not hold. In Mode B, where lawfully permitted, we notify the customer before responding to any legal demand and give them the opportunity to challenge it. Where we are prohibited from notifying, we challenge that prohibition.
Mode B material is deleted on the schedule above and certified on request. Records the software generated in the customer environment belong to the customer and always did. The licence carries a perpetual right to read and reproduce them, plus a frozen reader binary the customer keeps, precisely so that ending the relationship does not endanger their own audit trail.
Data enquiries are answered within five working days. A deletion request is acted on immediately and confirmed in writing.
Data protection requests have their own route on the contact form. It reaches the people who wrote these terms rather than a shared inbox or a ticketing queue.
What this page does not cover
The commercial terms of an engagement, which are in the licence and the engagement contract. The customer's own obligations as controller of the data the software processes in the customer environment also sit outside it, and remain the customer’s throughout.
This site sets no cookies and runs no analytics. The contact form holds a submitting IP address for up to ten minutes purely to limit abusive volume, unlinked to identity and never stored alongside message content.
This policy states the position we hold ourselves to. It is under review by a qualified data protection solicitor, and the entity registration referenced above is in progress.