Your data stays yours.

NDA and contract

I sign client NDAs, including mutual NDAs. I can work from your paper or provide a standard mutual NDA. The MSA and SOW cover scope, confidentiality, IP, data protection, warranties, liability, termination, and the change-order process.

The contract includes a “no training on client data” clause by default. If a model provider's terms allow training on inputs, I use the enterprise or zero-retention configuration, or a provider that does not train on API data. If neither is available, I say so before the work starts.

Working inside your environment

The default is to work in your repository, your cloud account, and your tooling. I do not copy production data to a personal machine unless the SOW says otherwise and the data is minimized. When I need samples, I ask for the smallest set, prefer synthetic or redacted records, and delete them at the end of the engagement.

Access is least-privilege and time-bound. I use named accounts, SSO where available, and a password manager. I do not share credentials over email or chat. Access is revoked at the end of the engagement, and I confirm it in writing.

Data handling

• No training. Client data, prompts, documents, and outputs are not used to train models or improve a product.
• No resale or benchmarking. Client data is not used in public benchmarks, case studies, or demos without written permission and sanitization.
• Minimization. Collect only what the diagnostic or build needs. Prefer metadata and synthetic examples before real records.
• Retention. Project data is deleted or returned at the end of the engagement, subject to the contract and legal retention requirements.
• Subprocessors. The stack may include a model API, a cloud host, and a source-control provider. I list the material subprocessors in the SOW and do not add one for client data without notice.

Application security

For builds, the default baseline is: secrets in a managed secret store, not in code; least-privilege service accounts; encrypted transport; dependency and container scanning in CI; authentication and authorization reviewed before launch; and a threat model for the AI-specific surfaces — prompt injection, tool abuse, data exfiltration, and unsafe output.

AI systems get the same review as any other production system, plus the parts that are specific to models: an eval harness, an output guardrail, a fallback path, a cost cap, and a trace that records which model, prompt version, and retrieval set produced an answer.

Incident notification

If I become aware of a security incident affecting client data, I notify the client without undue delay and within 72 hours where the contract requires it. The notice describes what happened, what data was affected, the containment steps, and the remediation plan. I cooperate with the client's incident process and regulators as required.

What I do not claim

I am an independent consultant, not a managed security provider or a compliance certification body. I do not claim SOC 2, ISO 27001, HIPAA, or PCI certification for my own practice. If your engagement requires a certified provider, I will say so before you buy.

Payment and business details

Invoices are in USD through Skydo, Wise, or Stripe. W-8BEN is provided. The contracting entity is Synthworx DNS Ventures LLC. Wire and ACH details are sent on the invoice, not over email in an unsolicited message. If you receive a payment instruction that looks different, verify it with me at hello@synthworx.com before sending anything.