Revised 2026-11-07
Your data, and the AI we put near it.
What we commit to on every engagement, before you share anything. The contract repeats these commitments; where the two differ, the contract wins.
Your data stays yours
- We build in your accounts where we can: your cloud, your model-provider keys, your billing. You can see and remove our access at any time.
- When the work needs a copy of your data, we take the least it needs, keep it encrypted, and delete it when the work ends.
- We sign a confidentiality agreement before you share anything sensitive, if you want one.
No training on your data
- We never use your data to train or fine-tune a model for anyone else.
- Your data goes only to model providers whose terms rule out training on it:Anthropic's commercial terms, the OpenAI API andGoogle's paid Gemini API tier. Free tiers that keep inputs for training are never used with client data.
- If you want a model fine-tuned on your data, that happens only on your instruction, in your account, and the result is yours.
- Where data must not leave your network, we run open-weight models on your own infrastructure instead.
People stay in charge
- Anything an agent does to a customer, a payment or a record goes through a person's approval until its evaluation set shows it can be trusted. You decide when that is.
- Every AI feature ships with a test set and a regression check, so a model or prompt change that makes answers worse is caught before release.
- People are told when they are talking to an AI.
Access and security
- Secrets never go into code repositories. Each project gets its own credentials, with only the access the work needs.
- Code reaches your systems through pull requests that pass automated checks first.
- If we find that your data has been exposed, we tell you as soon as we know, and within 72 hours at the latest.
- Security problems in anything we run can be reported under our disclosure policy.
When the work ends
- You get the code, the documentation, the runbook and every credential we set up.
- We remove our access, delete our copies of your data and confirm it in writing.
- Who owns the code we write, and the reusable components it builds on, is set out in the contract before work starts.
Personal data and the law
For personal data in your systems, we act on your instructions as your processor, under India's Digital Personal Data Protection Act, 2023 and, where it applies, the GDPR. A data processing agreement is part of the contract when personal data is involved. How this website handles its own visitors' data is in theprivacy policy.
Questions about any of this go to privacy@wytor.ai.