Security and data
The question that usually comes last, answered first. Specifically, because a page that only says it takes security seriously is a page with nothing to disclose.
Only the systems a workflow needs, and only the parts of them it needs. A quote-to-invoice build reads job sheets and writes invoices; it has no reason to see payroll, so it cannot.
Access is requested per system, in writing, with the scope named. If a request looks broader than the job, push back on it. We would rather explain the scope than have it granted without anybody reading it.
Between your systems, through the workflow, and back. Data in transit is encrypted. Nothing is copied to a laptop and nothing is stored anywhere it does not need to be.
Where a workflow has to hold something briefly, a queued record waiting for an API to come back for instance, it is held encrypted and cleared once it lands.
Only where a step genuinely needs a model, and only that step's content. A workflow that reads a photographed job sheet sends the sheet. It does not send your customer list.
We use enterprise API tiers, where the provider's terms state that submitted content is not used to train their models. Which providers a build uses is named in the handover document, and you can rule any of them out before we start.
No. Not ours, because we do not train models. Not theirs, because the API terms we work under exclude it.
If you need that in a contract rather than on a web page, ask and we will put it in one.
The people building your system, and nobody else. Credentials live in a secrets manager, not in a message or a spreadsheet, and access is removed when a project ends.
Every account we hold on your systems is separate and named, so you can see it in your own audit log and revoke it yourself at any moment without calling us.
Logs of what ran for 90 days, so a problem in March can be explained in April. The content those runs handled is not retained beyond what the workflow needs to finish.
At the end of an engagement we delete credentials, remove our access, and hand over the exports. Say the word and logs go early too.
We are a small team rather than a certified enterprise vendor, and we are not going to claim a compliance badge we do not hold. What we can do is name every system, scope and provider a build touches, in writing, before it is connected.
Yes, before the first detailed conversation if you would rather. Send yours or ask for ours.
Often, but it depends on the rules you operate under and it is a conversation before it is a project. Where a business associate agreement or an equivalent is required, that is signed before anything is connected, not after.
Yes. Several clients run the workflow engine on their own infrastructure and we build into it. It costs a little more to set up and it means your data never leaves your estate.
You hear from us the same day, with what we know, what we have done, and what we have not yet established. We would rather tell you something incomplete quickly than something tidy late.
Yes. Ask for the handover document, which names every system, every scope and every provider a build uses. It exists whether or not anybody asks for it.
Something here not covered? Ask us directly, or read the privacy policy and terms.