Security & data handling
The contractual, technical and personnel controls that apply to client data, described as they actually operate — including the parts where the honest answer is "ask us and we will tell you".
Security pages are usually written to reassure. This one is written so that your security reviewer can find out what is true without a call.
Annotation is unusual among data services in that humans necessarily read the data. Encryption at rest is straightforward; the harder question is who is in a position to read a record, on what device, under what agreement, and for how long after the project ends.
So the controls that matter most here are the ones governing access and personnel — who is staffed on a project, what they can reach, what happens on their screen, and what obligations survive their leaving it. Infrastructure controls are necessary and are described below, but they are not where this kind of work goes wrong.
Everything on this page is agreed per engagement and written into the contract. Where a requirement of yours is stricter than our default, it becomes a contractual term rather than an assurance.
At a glance
Controls
Six areas, each configurable upward for engagements that require it.
Nothing is shared before an NDA is signed, and personal information is handled under a data processing agreement that names the purpose, the scope and the retention period.
Access is granted per project to the people staffed on it, at the minimum level the role requires, and revoked when the assignment ends rather than when someone remembers.
Each engagement runs in an isolated environment, and we can work inside your platform instead if your policy requires the data never to leave it.
Annotators are bound by individual confidentiality agreements, briefed on the handling rules for the specific project, and their obligations continue after the project ends.
Data is retained only for the agreed period and deleted by the agreed method, with written confirmation once deletion is complete.
A defined internal escalation path, prompt notification to you, and a written account of what happened rather than a reassurance that it has been dealt with.
Lifecycle
Each step is a contractual term, not a policy statement.
NDA signed, and where personal information is in scope, a data processing agreement naming purpose, scope and retention. Transfer method agreed in writing.
Data lands in the environment agreed for the engagement. Access is provisioned for the project team only, at the level each role requires.
Work happens inside that environment. Access changes as staffing changes, and access logs are retained for the duration.
Deliverables are transferred by the agreed method. Working copies are consolidated so that what remains is known rather than assumed.
Data is deleted at the end of the agreed retention period by the agreed method, and we confirm the deletion in writing.
Plain statement
This section exists because the absence of a claim is easy to miss on a security page.
We do not hold or claim any certification, audit report or attestation that is not stated explicitly in our contract with you. If a certification scheme matters to your procurement process, ask us directly and you will get a direct answer about whether we hold it — including when the answer is no.
We do not publish uptime figures, breach statistics or accuracy guarantees, because we have not had them independently verified and an unverified number on a security page is worse than no number at all.
We do not retain client data for internal reuse, model training or portfolio purposes. Sample material shown on this website is our own, created for illustration.
If a real certification is ever obtained, it will be added here deliberately, with its scope and its date. It will not arrive as filler.
Procurement
The things worth asking us, and what we can provide without a lengthy process.
FAQ
The questions a security reviewer asks first.
We do not claim any certification that is not written into our contract with you. Ask us directly about a specific scheme and you will get a direct answer rather than a deflection. We would rather lose a procurement process for telling the truth than win one and be found out during an audit.
No. Access is granted per project, at the minimum level the role requires, to the people staffed on it. Where a dataset contains material that only part of the team needs, access is partitioned accordingly. The staffing list for your project is available to you on request.
Yes. We regularly work inside client-provided annotation platforms and virtual desktops where policy requires that the data never leave your infrastructure. It changes the tooling, not the guideline or the review process, and we will tell you where a restriction genuinely limits what the QA process can do.
Where a project involves personal information we operate as a processor under a data processing agreement that names the purpose, the scope and the retention period, and we follow the handling instructions in that agreement rather than a general policy. Japan’s Act on the Protection of Personal Information, and where relevant the GDPR, shape those terms. We are not in a position to give you legal advice on your own obligations, and we will say so rather than improvise.
It is deleted at the end of the retention period agreed in the contract, by the agreed method, and we confirm the deletion to you in writing. We do not keep client data for internal reuse, for model training or as portfolio material. If you need a shorter retention period than our default, that becomes a contractual term.
Security
We would rather answer your security review in your format, before a pilot, than describe our posture in general terms on a web page.
NDA before you share any data. Pilot scoping is free.