Security and compliance
We introduce AI in a way that your IT team, legal department and data protection officer can review.
Data classification
Three levels of data sensitivity
Three levels of data sensitivity
We set the classification together with you and write it into the policy.
- 01Does not go into a toolhealth databiometricspayment dataprofessional secrecySpecial categories of personal data and sector-regulated content. This is not a limitation of one provider, but a general limitation of processing in the cloud.
- Health data of individuals
- Biometric and genetic data
- Payment cards and bank data linked to personal data
- Legal and banking secrecy
- 02With care and approvalsalariesprices before releaseconfidentiality undertakingssource codeThere is no legal prohibition, but there is a business risk. It is handled with limited access and after checking contractual commitments.
- Strategies and pricing before release
- Salaries and HR data
- Contracts with confidentiality undertakings
- Source code that is the core of the company’s assets
- 03No concernsquotesinternal guidancereportsmarket analysesThis is where most of the actual use is and where most of the value is. This part does not need caution, it only needs a good setup.
- Sales communication, quotes, presentations
- Internal documentation and guidance
- Analyses of the market and of publicly available data
- Technical documentation and reports
For levels 02 and 03 we determine:whether the data has to be anonymisedwhether it has to stay inside the EUwhether it may go to the cloud or only to the device or an internal server
Three questions we teach every employee
Before any content goes into a tool, the employee answers three questions. If the answer to any of them is yes, the content stays out or goes through anonymisation first.
- 01Does the content contain special categories of personal data, payment data or sector-regulated content?
- 02Does the content carry a confidentiality undertaking with a third party that restricts processing in the cloud?
- 03Would it worry you if this content stayed for a short time in the logs of a business platform that does not use it for model training?
Where your data is
Processing where your rules allow it
Processing in the EU, where that is a condition
In public administration, healthcare and finance, where the data physically sits is a condition, not a detail. In those cases we design the architecture with processing inside the European Union. If that is not feasible with the chosen tool, we say so up front.
The environment you already have
Where the organisation already pays for Microsoft 365, Azure or Google Workspace, we build the solution inside that environment. Data stays under your existing contracts, access controls and oversight.
Business licences with no training on your data
We work exclusively with business tiers of AI providers, where content is contractually excluded from model training. We check the provider’s contractual commitments and write them into the specification.
Anonymisation before processing
Where personal data is unavoidable in the content, we remove it before the content reaches the tool, using our own solution developed together with data protection specialists.
Integration with your environment
We build on the systems you already use
We do not ask you to replace tools. The solution connects to your existing environment with a precisely defined scope of access.
Microsoft 365 and Azure
Outlook, Teams, SharePoint, OneDrive and Azure OpenAI. Access through the organisation’s business tenant, limited to specific folders and mailboxes; models can run inside your own Azure environment.
Google Workspace
Gmail, Drive and Calendar. Limited scope: a specific folder rather than the whole environment, read only where that is enough.
Single sign-on (SSO)
Sign-in to business AI environments through Microsoft Entra ID or the organisation’s Google account, so access ends together with the employee’s account.
ERP and accounting systems
Pantheon, Vasco and others, through an API where one exists, otherwise through a controlled data export. Writing back into the system only by explicit agreement.
CRM systems
Intrix, Pipedrive and custom CRMs. Reading for drafts and reports, writing on the principle that a person confirms.
Telephony and SMS
Voice agents and SMS notifications through business telephony providers, with AI disclosure on first contact and a transcript for your team.
Automation layer
REST APIs and webhooks between the systems you already have. Every data flow is described in the specification, field by field.
For every system we check before the start what kind of access is possible and safe, and write it into the specification.
How we run a project
Four steps, each with a written outcome
- 01Process analysisInterviews with staff and a review of where the time goes. Already here we classify the data involved into the three sensitivity levels.
- 02Specification and security reviewWe write down which data goes where, who has access and why. Access follows the principle of least privilege. Your IT team reviews the document before anything is built.
- 03Pilot on a limited scopeOne solution, one team, a limited set of data. The pilot shows whether the solution works and whether people use it, before you decide to extend it.
- 04Rollout and supportEvery change in production is agreed and logged. We train staff on their own cases, because change management is part of the rollout and not an add-on.
Support and response times
After launch the solution is not left on its own
After launch we maintain the solution under a monthly support agreement. Response times, availability and the procedure for incidents are written into the support contract.
Documentation
What your legal and IT teams need to decide
We provide these documents as part of working together, tailored to your solution and your environment. The first step is an intro call where we learn about your processes and systems; on that basis we prepare the documentation your procedure requires.
- Data processing agreement (DPA)
- List of sub-processors
- Internal AI usage policy (template for the client)
- Architecture and data flow description for each solution
Compliance
Three frameworks we work within
GDPR
Data classification, a processing agreement, limited access and anonymisation where needed. What exactly we do is written above; we make no blanket claims of compliance.
EU AI Act
Staff who use AI are trained and the training is documented. Where AI communicates with a person, it says so on first contact, as our voice agents and advisers do.
Human oversight of decisions
The system prepares a draft, a person decides and sends. Wherever a solution would affect an individual, a person is in the loop without exception.
Start with the first step
In half an hour we look at where your time is going and work out whether we can help. If we cannot, we tell you.
30 minutes, no preparation and no obligation