Privacy Policy

Data Isolation Approach

We design client workloads for logical separation and restrict access according to the applicable service configuration and customer agreement. Specific isolation and encryption controls depend on the deployed product and environment.

We do not authorize client content for public-model training unless the customer has received a specific disclosure and provided any consent required by the applicable agreement and law. Service providers may process limited data to operate and secure a service as disclosed in the applicable notice and contract.

Local-First Model Prioritization

Some platform workflows are designed to prefer local processing. Processing location and any external service providers vary by product and configuration.

Restricted data must not be routed to an external provider unless the data classification, customer authorization, provider terms, and applicable privacy requirements have been approved. Current provider routes remain subject to governance holds where that evidence is incomplete.

Secure Credential and Secret Management

Production credentials are intended to be managed through approved secret-storage and runtime-injection controls. Credential custody, rotation, logging, and storage requirements are assessed per environment.

Customers should not send credentials through ordinary support, email, analytics, or AI prompt channels.

Privacy and AI Governance Status

We maintain a risk-based privacy and AI-governance program. GDPR, UK GDPR, the EU AI Act, and other jurisdiction-specific duties apply only where their territorial, entity, product, data, and role requirements are met. We do not claim certification or universal compliance with those regimes on this page. Customers should request the product-specific privacy notice, processing terms, subprocessor information, and compliance scope before providing regulated data.