Security
Privacy is part of the product, not a footer.
These are the commitments we make about data handling. They are the same here, in our sales conversations, and in our agreements.
Our trust statement
Your raw data is processed offline.
All cleaning and de-identification runs locally using open-source tools. During processing, raw data is not sent anywhere and is never entered into cloud AI tools. Only the approved, de-identified licensing copy may leave the processing machine.
De-identification
Four steps before anything is approved.
1
Detect
Identify sensitive fields in structured data and free text.
2
Remove or replace
Remove or replace identifiers and identifying information.
3
Retain context
Preserve useful, non-identifying operational detail.
4
Validate
Run audits before approving the de-identified licensing copy.
How processing runs
- Records are cleaned, standardized, and deduplicated on a local machine.
- Personal information is detected and redacted locally, in structured fields and in free-text notes.
- Every step is scripted, repeatable, and validated before any output is approved.
Ownership and sharing
- The business keeps its originals.
- Only an approved, de-identified licensing copy is shared.
- Only de-identified output leaves the processing machine.
- Our working copy of your raw records is kept only for the license term, then deleted.
How data moves
Nothing moves before review. Nothing public.
Raw data moves only after identity, authority, rights, scope, and handling terms have been reviewed. When it does, it moves through an approved secure data room with access controls, retention limits, logging, and a named internal owner. There is no public upload portal.
What we commit to publicly
- The initial assessment uses business metadata only.
- No raw data is requested on public forms.
- No delivery happens before scope and terms are approved.
- Original systems remain with the business.
- De-identification and security methods are documented.
- Commercial outcomes are not guaranteed.
How we run the operation
- Server-side validation and rate limiting on every form
- Encryption in transit and at rest
- Least-privilege access with audit logs
- Lead records kept separate from any data workspace
- A written retention and deletion policy
- A named owner and process for incident response
Limits
What we will not claim.
- We do not describe de-identified data as anonymous.
- We do not say any process is risk-free, or that de-identified data could never be traced back to a person.
- We do not call a dataset compliant on our own say-so. Rights and privacy questions are reviewed with qualified counsel.
Documentation
Request our security documentation.
For owners, counsel, and procurement teams. A named person on our team will reply.