Security and data
How we handle your traces, credentials and code, which contracts we sign and what we don’t have yet. If your security team has a questionnaire, send it to security@volansaquilae.com and we’ll answer it in writing.
Where the work runs
By default, inside your environment. The eval suite runs in your CI with your model API keys. A review needs read-only access to staging, and read access to your production traces, either through read-only accounts you create in your own tracing tools or as a pseudonymised export. It never needs write access to production.
For personal data from the EU or the UK, a pseudonymised export is our default, so names, emails and account numbers stay in your systems unless you choose otherwise. Our engineers work from Thailand, so remote access to EU or UK personal data is an international transfer, covered by the contracts below.
We send your data to a model only through your own API accounts, under your agreement with that provider. We never paste it into personal AI tools, and we never use it to train models.
If you send us data
If you’d rather export a set of pseudonymised traces, we store the export encrypted at rest in our Namecheap hosting account, give access only to the engineers named in your plan, and delete it within 30 days of the end of the engagement. We confirm the deletion in writing.
Your environmentwhere the work runs by default
- Production traces read in your own tools, through read-only accounts you create
- Staging read-only, with no write access to production, ever
- The eval suite runs in your CI and stays in your repository
Model providers
- Only through your API accounts, under your agreement with the provider
- Never pasted into personal AI tools, never used to train models
Our sideonly if you send an export
- Pseudonymised, encrypted at rest in our Namecheap hosting account
- Open to the engineers named in your plan
- Deleted within 30 days, confirmed in writing
Security measures
The technical and organisational measures we apply to every engagement, and list in the data processing agreement:
- One named account per engineer, never shared, with multi-factor authentication.
- The narrowest access the work needs, asked for in writing before day 1.
- All access is removed on the last day, and we send you the list to check.
- Work laptops use full-disk encryption and a password manager. Client work stays in client-specific accounts and repositories.
Contracts
- A mutual NDA, signed before you share anything. We sign yours, or work from a standard mutual NDA if you don’t have one.
- A data processing agreement under Article 28 of the GDPR and the UK GDPR, which names our sub-processors. We sign yours where you have one.
- We’re based in Thailand, which has no adequacy decision from the European Commission (Commission list). For personal data from the EU we sign the standard contractual clauses of 4 June 2021. For data from the UK, the ICO’s International Data Transfer Agreement or the UK Addendum to the EU clauses (ICO guide). The clauses require a transfer risk assessment, and we complete it with you before any personal data moves.
- Code and documents are assigned to you, and every engagement ends with a written handover.
If your security team has a questionnaire, send it to security@volansaquilae.com and we’ll answer it in writing. Our guide to the AI vendor security questionnaire shows the questions we expect and the evidence a review gives you.
Sub-processors
| Service | Used for | Data location |
|---|---|---|
| Namecheap | Hosts this website and its access logs, our email, including contact-form messages, and the trace exports clients choose to send us | Named in your data processing agreement |
We give 30 days’ notice before adding a sub-processor that handles client data.
If something goes wrong
We tell you within 24 hours of finding an incident that affects your data, with what we know, what we’ve done and what happens next. Then we follow up in writing as we learn more.
To report a vulnerability in our own systems, see our security.txt or email security@volansaquilae.com.
Certifications
We don’t hold SOC 2 or ISO 27001 today. Some regulated buyers require one of them from every supplier. If yours does, we may not be able to work on systems that hold personal data yet.
Company details
Volans Aquilae. Our registered company name, address and registration number are in every proposal and contract. Email info@volansaquilae.com.
Where the GDPR or the UK GDPR requires us to appoint a representative under Article 27, we’ll name them here.
How we handle the personal data of people who contact us is in the privacy notice.
Send us your security questionnaire
We answer it in writing before a review starts, and say plainly where we don’t meet a requirement yet.