Handing your business's information to a team in another country is a fair thing to worry about. So here is exactly what happens to it, in order.
Before we start: an NDA
We sign an NDA before we see anything: before your documents, your prices or a first look at how your business runs.
While we build: sample data
We build and test on sample data, not your real records. For document processing, we test on sample documents that match yours, and tell you the error rate before we quote.
At go-live: your accounts
Real data connects only when an automation goes live. It runs inside accounts set up in your name: the phone number, the AI services and the messaging accounts. We do not copy your customer data into our own systems.
For the first weeks, the AI drafts and a person on your team approves. Accuracy is measured again on your real data during that supervised start.
Where it lives: services chosen by country
We choose services by country, so your data stays where your local rules need it to be. Some countries require certain data, such as health data, to stay inside the country. Where that applies, we use services hosted there.
For US healthcare practices, we sign a HIPAA business associate agreement before handling any patient information. We use vendors who sign one with us, and keep US patient data in a US region.
On every project
- We ask only for the access a job needs, and remove it when the work ends, unless you keep us on the on-call engineering retainer.
- Secrets live in a secrets manager or your provider's vault, never in code, chat or email.
- We use AI services whose terms exclude training on your data, and each quote names the providers involved.
- AI only sees the information a task needs.
- Every automated action is logged, and anything that can't be undone waits for a person.
What we don't have yet
We don't hold a formal certification such as SOC 2 or ISO 27001. If your business needs one from its suppliers, tell us before we start. We'll say honestly whether we can meet your requirements.
Questions
Read security, in full, or email security@xwits.dev. A person reads it and replies within one working day.
