Security & Data Handling
Last updated: June 2026
Security is a build decision, not an afterthought. Here is how we handle your data, your credentials, and your infrastructure on every engagement.
Where your data lives
Wherever possible, we deploy automations inside your own accounts and infrastructure, your CRM, your Google Workspace, your cloud. We do not store client operational data on shared servers. Dedicated instances and private model deployments are available on request.
Credentials and access
API keys and credentials are stored in secure secret managers, never in code or in git history. Access is scoped to the minimum needed for the workflow, documented at handoff, and can be rotated or revoked by you at any time.
Transport and headers
The site runs over HTTPS with HSTS. We set X-Frame-Options, X-Content-Type-Options, and a strict referrer policy. Lead-intake webhooks are authenticated server-side, credentials are never exposed in the browser.
Compliance-sensitive work
For healthcare, legal, and financial workflows we design around your regulatory requirements. For healthcare work we only use communication tools whose vendor signs a Business Associate Agreement (BAA), and patient data never goes into a tool without one. We disclose exactly what is and is not covered during scoping.
Reporting a vulnerability
If you believe you have found a security issue, email security@aidatahouse.com. See our security.txt at /.well-known/security.txt. We aim to acknowledge reports within two business days.