We are a software studio, not a security firm, and we don't pretend otherwise. What we can promise is to be specific, to work inside your controls rather than around them, and to put it in writing.
Where your data goes
We use AI providers under their business and API terms (Anthropic, OpenAI, Google, and the models available inside Microsoft Azure and AWS). Under those terms your data isn't used to train models and isn't retained beyond what's needed to serve the request. We never use consumer chat accounts for company data, and we'll say so in your policy.
If a workflow needs a provider that can't meet your requirements, we pick a different one or we tell you the workflow isn't a fit yet.
Where things run
By default, in your cloud account or ours on major providers (we usually build on Vercel, Supabase and AWS). For companies with a data residency or private networking requirement, we deploy inside your Azure, AWS or Google Cloud tenant. On-premise is possible for retrieval and automation workloads and rarely needed.
Every project ships with a one-page diagram of what runs where and what talks to what.
Who can see what
Access mirrors what you already have. Document search respects the permissions in SharePoint, Drive or your file server, so people only see what they could already open. We connect through your identity provider where one exists.
Early staff get least-privilege access for the duration of the build and we hand credentials back at the end. We'll sign your NDA and your vendor security questionnaire.
What we never do
No scraping your systems into a side database nobody owns. No company data in personal AI accounts. No shipping an agent that can take an action nobody approved. No training a model on your data without a written agreement to do exactly that.
Regulated industries
Healthcare: providers with a BAA, PHI minimization, and audit logging. Finance and insurance: data retention rules and model documentation. Government contracting: CMMC and ITAR constraints, which can rule out some providers and regions. Legal: privilege and conflict handling. We have worked with each; the assessment maps which rules apply to which workflow before anything is scoped.
What your IT team gets in writing
- A data map: each system, the data that leaves it, where it goes, and why.
- An architecture diagram of what runs where.
- The list of third-party services and their terms.
- Access list and a hand-back date.
- Monitoring: what is logged, where, and who sees it.
- An AI use policy for your staff, if you don't have one.
Ownership
You own the code, the prompts, the evaluation sets and the documentation. No licence to Early, no lock-in to a provider we chose. If you leave, everything comes with you.
How we use AI ourselves
We also use AI to build software faster, with people reviewing every line. How we use AI says what it does and what it doesn't.
Have a security questionnaire?
Send it. We'll fill it in before the first call.