Designed so that trust is checkable
These are design commitments built into how the platform works, not marketing claims about certifications.
Possession is not permission
Having a copy of a record does not mean it can be licensed. Ownership, client rights, employee data, third-party licences and confidentiality are assessed separately for every slice. Anything unknown stays unknown — it is never treated as cleared.
Least privilege, read-only
Connections request the narrowest read-only permissions available and are bound to the scope you approved. Changing the scope requires your approval again.
Quarantine and encryption
Raw records are stored in an isolated zone, encrypted per organization, and readable only under a short-lived, purpose-bound grant that is logged.
People decide the consequential things
Rights decisions, Dataset Cards, samples, terms, deliveries and lifting a security freeze all require a named person in the right role. Automated agents cannot make or override those decisions.
Kill switches
Outbound contact, ingestion, buyer delivery, model access to data and connectors can each be stopped instantly; work in progress pauses and resumes only when cleared.
A complete record
Every agent action, model call, policy decision, approval and state change is recorded in an append-only, hash-chained log, so any outcome can be traced back to who did what and why.
Deletion with receipts
Raw copies are deleted on the schedule in your agreement by destroying their encryption keys, and you receive a verifiable deletion receipt.
Plain language
We describe de-identified data as de-identified or pseudonymised — not anonymous — and we do not make guarantees about value or outcomes.
Questions about a specific control? Contact us from the address in any message we have sent you. To see, correct or delete data we hold about you, use the privacy request form; to stop all contact, use the unsubscribe page.