Security and trust
Control, and a named owner.
The questions a portfolio company asks before the work starts, answered with how the engagement runs.
Where does our data go, and who can access it?
A production-scoped pilot builds one tightly scoped workflow in the portfolio company’s own production systems, using access the company controls and can revoke. The work runs in the portfolio company’s own tenant and systems: Microsoft, Google, AWS, or the stack it already runs. Company data stays in that environment. Our engineers join the company’s team and work in its repositories, through its identity provider, and inside its security and change process. Access starts at least privilege, scoped to the workflow in the agreement, and the company can revoke it the same day. A mutual NDA is signed before sensitive material changes hands. Early work uses samples with the sensitive fields removed, or samples made for the exercise. The company’s security owners review who can reach the systems, how data moves, and which tools are in use. A data-handling agreement is signed before regulated records are in scope. Client data and code stay out of model training. The provider follows the company’s compliance needs.
What can an agent do on its own, and what needs approval?
An agent prepares work inside the named workflow: the draft, the match, the call, the report. A person at the company approves every commitment that leaves the building. AI-assisted work is reviewed and tested, and a named person owns it. The change clears review before it ships.
Can we see what happened, and stop it?
Every agent action leaves an audit trail. Each agent has an off switch. Models and tools are chosen for the regulations that apply, starting with the engagement. The usage rules are written for the company’s security lead to sign. The board pack includes the controls and the count: tasks, hours, and document value.
Who is responsible if something goes wrong?
A named person owns each change. An incident is raised with the portfolio company’s security contact. Our team stays with it until the company closes it.
What remains ours, and what happens when the engagement ends?
The work product is assigned to the company in writing. A mutual NDA is part of the start. Licensing is the agreement already signed. When the engagement ends, access is revoked. The company keeps the workflow, the documentation, and the audit trail.
For reviewers
Request our security package.
Book an intro call and ask for the security package.
Book an intro call