Security
Effective 2026-09-08 · How we handle client data and how the systems we build behave
Where client data lives
- On encrypted storage under our control, on machines we own. Not on shared cloud drives.
- Never in a public repository. Client data and credentials are kept outside version control by rule, and the rule is checked before every commit.
- Never sent to third-party AI services. The composition, retrieval, and decision logic in our systems is deterministic and runs locally; no client document, image, or record is processed by an external model.
- Returned or deleted at the end of the engagement, as the agreement states, and confirmed in writing.
How the systems we deliver behave
- On-premise by default. A Zymbio runs on the client’s hardware, or on a single-tenant instance we operate for the client, behind authentication. It keeps working without internet.
- Deterministic. Same input, same output. Every answer is traceable to a rule, a source, or an approved asset, so it can be audited after the fact.
- Built to stop. When a case falls outside what the system knows, it flags it for a person instead of guessing.
- Automated checks. Every delivery ships with its own test suite and judges that run on their own and report when something breaks.
- Pinned dependencies. Deliverables run from locked, hash-verified requirements, so what we tested is what runs.
Access
Access to client systems is limited to the people named in the engagement agreement. Where a client grants us access to their own systems, we ask for the least privilege needed, read-only wherever possible, and we say so in writing when we do.
Reporting a problem
If you find a security issue on our sites or in a system we built, write to [email protected] with the details. We acknowledge within two business days and tell you what we did.
Seguridad
Vigente desde 2026-09-08
Los datos de cliente viven en almacenamiento cifrado bajo nuestro control, en máquinas propias; nunca en repositorios públicos (datos y credenciales van fuera del control de versiones por regla); nunca en servicios de IA de terceros (la lógica de composición, recuperación y decisión es determinista y corre local); y se devuelven o eliminan al cerrar el proyecto, con confirmación por escrito. Los sistemas que entregamos corren on-premise o en una instancia de un solo cliente con autenticación, siguen funcionando sin internet, son deterministas y auditables, se detienen y avisan a una persona cuando un caso sale de lo que saben, y se entregan con sus propias pruebas y jueces automáticos, con dependencias fijadas y verificadas por hash. El acceso a sistemas del cliente se limita a las personas nombradas en el contrato, con el mínimo privilegio necesario y de solo lectura cuando se puede. Para reportar un problema de seguridad: [email protected]; acusamos recibo en dos días hábiles.