Security & trust
AI systems touch your most sensitive data and workflows. Here is exactly how we handle both.
Your data is never used for training
Client data is never used to train or fine-tune models for anyone else. Where providers offer zero-data-retention terms, we use them for sensitive workloads.
Deployed in your cloud
We can build and run systems inside your own AWS, Azure or GCP account or VPC, under your existing identity, network and logging controls. Open-weight models can be self-hosted when data must not reach any third party.
NDA and DPA as standard
We sign a mutual NDA before discovery and a data processing agreement before we touch personal data.
Least-privilege access
Engineers get only the access a task needs, for as long as it needs it. Credentials live in your secret manager, not in code or chat.
AI-specific controls
Prompt-injection defences: retrieved content is treated as untrusted data, and agents get least-privilege tool access
Human approval before any irreversible or high-impact action
PII detection and redaction before data reaches a model where required
Permission-aware retrieval, so users only get answers from documents they can already see
Full audit trail of prompts, sources, outputs and approvals
Evaluation suites and monitoring to catch quality regressions before users do
Certifications
TODO: SOC 2 Type II — confirm type and report date, or remove
TODO: ISO/IEC 27001 — confirm certificate number, or remove
Reports and our security questionnaire are available under NDA — email hello@victorlabs.co. See also our privacy policy.