Trust & data

How we handle your data.

We work in fields where data is sensitive and mistakes are expensive. These are the rules we follow on every engagement.

Before we start

• NDA first. We sign a mutual NDA before you share anything confidential.
• Written scope. What data we need, why, and for how long is agreed in writing before access.
• Least access. We ask for the smallest data set that answers the question. Synthetic or de-identified data when it is enough.

Where your data lives

• Your environment first. Where possible we work inside your cloud account or on your hardware, so data does not leave your control.
• On-prem options. Our own tools are built for it. The ReasonGate core runs with zero dependencies and makes no network calls.
• Hosted models, by agreement. If a project uses a hosted model API, we name the provider and its data terms before any data moves, and we do not proceed without your approval.

During and after

• No secondary use. Your data is used only for your project. We do not use it to train models for anyone else.
• Return or delete. At the end of an engagement we return or delete your data and confirm it in writing.
• Audit trail. The systems we deliver log their decisions, so you can see what the AI did and why.

Compliance

We design systems with your compliance team for the rules that apply to you, such as HIPAA, GDPR and the EU AI Act record-keeping requirements. We do not currently hold SOC 2 or ISO 27001 certification, and we will not claim a certification we do not have.

Security contact

To report a vulnerability in any of our products, email info@cairnstonelabs.com with "Security" in the subject.