Security and trust.
How we handle your data, your systems and the AI we build into them. Plain answers, so your IT and compliance teams know what to expect before we start.
What you can count on.
-
Your accounts, your code
We build in accounts you own or control. The code, data and logins are yours from day one, and nothing depends on an Inkwell subscription.
-
Only the access each step needs
Every connection gets its own account with the narrowest permissions that work. We remove our access at handover, or whenever you ask.
-
People approve what matters
AI drafts and checks. A person approves anything that moves money, reaches a customer or changes a record that matters, and the system keeps a record of who approved what.
-
Careful with AI providers
We choose providers and settings that match your requirements. With OpenAI's business services, your data isn't used to train its models by default (OpenAI business data privacy). We're a Registered Partner in the OpenAI Partner Network and work with other providers when they fit better.
-
Built to be watched
Every system logs what it did, alerts the right person when something fails, and has a place to see and retry failed work.
Working inside your rules.
Healthcare, insurance, law firms, education and government contractors each have their own requirements, such as HIPAA, state insurance data-security laws, bar guidance on AI, FERPA and contract clauses like CMMC. We design to yours from the first conversation and work with your compliance lead. We don't claim certifications we don't hold.
Questions security teams ask.
Are you SOC 2 certified?
Not today. We're a small team and say so plainly. We'll complete your security questionnaire, follow your vendor review, and build inside your own environment and policies, which is often what a security team prefers anyway.
Will our data be used to train AI models?
Not by us. We use AI providers' business services, which don't train on customer data by default, and we check the settings for your project before anything sensitive is involved.
Where does the system run?
In accounts you own: your cloud, your Microsoft or Google tenant, or hosting you choose. Some vendors, like ServiceTitan, require it.
What happens if we stop working together?
Nothing breaks. You already own the code, data and accounts, and the system is documented for whoever works on it next.
Have a security questionnaire?
Send it with your project details. We'll answer it honestly.