Customer-controlled deployment
Products can be deployed on dedicated customer-controlled infrastructure with customer-managed data stores.
Security & Data Protection
Operational AI needs
operational trust.
AIA Core products are designed for customer-controlled deployment, transparent data flows, auditable actions and configurable human oversight.
Security controls are agreed around each customer's systems, workflows, data sensitivity and deployment requirements.
Data principles
Broad operational access. Controlled use.
An AIA agent may need to search across customer-authorised mailboxes, documents, management systems, operational records and knowledge sources to complete real workflows.
Access is authorised by the customer. Where technically possible, only information relevant to the current task is used or transmitted onward for model processing.
No marketing use or resale
Customer operational and personal data is not used to build advertising audiences, unrelated marketing profiles or commercial datasets for sale.
Authorised data sources
Customers decide which mailboxes, repositories, systems and workflows an agent is allowed to access.
Approved subprocessors
External providers are used only where required to deliver the authorised service under applicable contractual and data-protection terms.
Auditability
Material actions, approvals and overrides can be logged so customers can review what happened and who authorised it.
Credential separation
Passwords, API keys and system credentials are designed to remain outside prompts, documents and ordinary application logs.
Deployment architecture
Keep the operational core under customer control.
AIA products are designed to support private deployment while allowing carefully controlled use of external AI services where required.
Operational repositories, documents and databases can remain inside the customer-controlled environment.
Outbound access can be restricted to the systems and model providers required for the agreed deployment.
AIA support access can be customer-authorised, time-bounded where practical and included in the audit trail.
Technical & organisational measures
Controls are deployment-specific.
For a live pilot we document the controls actually enabled in the customer's environment rather than relying on generic security claims.
Data protection documentation
Document the real deployment before production data is connected.
For live pilots involving personal or confidential business data, the customer and AIA Core Technologies agree the processing scope and document the deployment.
DPAController/processor roles, instructions, confidentiality, subprocessors, deletion and incident cooperation where applicable.
TOMsThe technical and organisational controls actually enabled for the deployment.
Data Flow DiagramWhat the agent reads, where data is stored, what leaves the customer environment and why.
Subprocessor ListApproved external providers used to deliver the service and the purpose of their processing.
Security FAQ
Questions customers should ask.
Does AIA Core Technologies use our data for marketing?+
No. Customer operational and personal data is not used for advertising, marketing profiling, lead generation, resale or disclosure to third parties for their own independent purposes.
Does that mean no third party ever processes data?+
No. Some deployments may require approved subprocessors, such as an external AI model provider. Where used, they process data only to provide the authorised service under the agreed data-protection terms.
Can an AIA agent search broad operational mailboxes and documents?+
Yes, where the customer authorises that scope and it is necessary for the agreed workflows. Broad search access is separated from outbound disclosure and task-level use.
Is data used to train OpenAI models?+
Where the OpenAI API is used, API inputs and outputs are not used to train OpenAI models by default unless the customer explicitly opts in. Retention settings depend on the endpoint and account configuration.
Can AIA products be deployed in our own environment?+
Yes. AIA products are designed to support deployment on dedicated customer-controlled infrastructure with customer-managed databases and document storage.
Need to review AIA with IT, legal or DPO?
Contact us to discuss a deployment-specific security architecture. A customer-facing MAIA security overview is also available for maritime evaluations.