Security & data handling
How we handle your data.
What we access, what we do with it, how long we keep it and who ends up with it. If anything here doesn't fit your situation, ask us before you share anything.
The short answer
We access nothing until you decide. The assessment uses descriptions only. Any later access is to a scoped record set you agree to. It is de-identified before it is prepared for an AI company, and licensed only under a written agreement you sign.
What we access
Nothing, until you decide. The assessment and questionnaire use descriptions and counts only. Any later access is to a scoped, agreed record set — never a whole mailbox, ticketing system or database — and can be withdrawn.
How it's processed
Identifying details — names, contact details, account numbers, client names — are removed or aggregated before anything is prepared for an AI company. No de-identification method is perfect: if a source holds information you could never risk sharing in any form, leave it out of scope.
Storage and retention
Data is held only as long as preparation requires, under the terms written into your agreement. We do not keep copies beyond what the license allows.
Who receives it
Prepared datasets are licensed to AI companies for the uses defined in the license. They are not published, not resold, and not passed to anyone outside the agreement.
The agreement
Scope, permitted uses, retention and compensation are set out in writing and signed before any records are transferred.
What we need from you
Only share records your organization has the right to share. Customer, supplier and employee agreements can limit reuse; we go through those with you and, where needed, with legal specialists.
What is de-identification?
De-identification removes or changes the details that could identify a person, a customer or a counterparty. The goal is a dataset that keeps its value for AI without pointing back to anyone.
Common techniques include:
- Removing direct identifiers such as names, contact details and account numbers
- Replacing identifiers with codes (pseudonymization), with the key kept apart from the data
- Grouping values into ranges, such as age bands or regions
- Shifting or coarsening dates
- Dropping free-text fields that are hard to clean
No method is perfect. Combined with other information, some records can still be traced back to a person. That is why scope matters: if a source holds something you could never risk sharing, leave it out.
Data rights: what are you allowed to share?
Data rights are the permissions attached to data. Your company may hold records and still be limited in what it can share. Before anything moves, check:
- Customer and supplier contracts, including confidentiality clauses
- Employee agreements and internal policies
- Consents given by the people in the records
- Privacy and sector rules in the countries involved
We work through these with you, and with legal specialists where needed. This is general information, not legal advice. Our data licensing principles explain how we treat provenance and rights, and how it works shows each step of a license.
What stays in your control
- Scope
- You decide which records are in and which stay out.
- Release
- Nothing moves without your written authorization.
- Ownership
- A license grants defined uses. Ownership does not transfer.
- Access
- Access to a scoped record set can be withdrawn.
FAQ
Questions about data handling.
Do you need access to our systems?
No. The assessment and questionnaire use descriptions and counts only. If a project goes ahead, you export an agreed, scoped record set. We never take a whole mailbox, ticketing system or database.
Is de-identified data the same as anonymous data?
Not always. De-identified data has identifying details removed or changed, but some risk of re-identification can remain. Your counsel decides which standard applies to your records.
Will our data be resold or published?
No. Prepared datasets are licensed for the uses defined in the license. They are not published, not resold and not passed to anyone outside the agreement.
Who decides what can be licensed?
You do, with your counsel. We help find the limits in contracts and consents, but nothing is licensed without written authorization from someone entitled to give it.
Questions about data handling?
Write to us before you share anything, or read the principles we apply to every dataset.