Security & Trust

Customer data is processed only for the purpose of delivering agreed AI systems, integrations, and workflow automation services. Processing is scoped to the engagement and is designed around purpose limitation, data minimization, access control, retention, and deletion requirements.

Core data-handling principles

• Customer data is not used by Madhi AI to train foundation models.
• Customer data is not shared across clients.
• Processing occurs only within approved workflows and agreed system boundaries.
• Access is restricted using role-based access controls and least-access principles appropriate to the deployment.
• System activity can be logged and audited within the agreed architecture.
• Clients retain ownership of their data, subject to the contractual terms governing the engagement.
• Retention and deletion requirements are defined for the deployment rather than left open-ended.

Where Madhi AI acts as a processor or service provider, we support the client’s documented instructions and can assist with rights requests, deletion, export, or investigation steps that relate to the systems we operate, subject to the agreed scope and applicable law.

Madhi AI systems are built on secure cloud or client-controlled infrastructure using industry-standard security practices. The exact control set depends on the selected deployment model and client requirements.

Typical security measures include

• Encryption in transit using TLS.
• Encryption at rest using AES-256 where supported by the selected storage and cloud services.
• Role-based access control (RBAC).
• Secure secret, credential, and key management.
• Infrastructure monitoring, logging, and auditability.
• Dependency and vulnerability scanning.
• Segregation of client environments and workflow resources.
• Backup, recovery, and retention controls defined for the deployment.

These measures are intended to reduce unauthorized access, accidental disclosure, cross-customer exposure, and loss of availability during both processing and storage.

AI introduces additional risks around prompt handling, model-provider retention, training use, output exposure, and downstream reuse. Madhi AI evaluates these risks as part of architecture and provider selection.

• Customer data is not used by Madhi AI to train foundation models.
• Prompts and outputs are not intentionally reused across customers.
• Enterprise model APIs and zero-data-retention configurations are used where available and suitable for the workflow.
• Model and provider choices are documented as part of the deployment design.
• AI systems operate within defined workflows and permissions approved by the client.
• Sensitive workflows can be designed to minimize or avoid external model-provider data transfer.

Provider terms, retention behavior, hosting region, subprocessor use, and model-specific limitations are reviewed as part of the solution design where they are relevant to client risk or regulatory requirements.

Madhi AI uses a risk-based approach to AI governance. The level of documentation, testing, human oversight, and user-facing transparency is matched to the use case and its potential impact.

Typical governance controls include

• Use-case and role assessment before production deployment.
• Defined system boundaries, tool permissions, and workflow constraints.
• Controlled evaluation and testing before release.
• Monitoring of outputs, errors, system performance, and material changes.
• Human review or escalation paths where appropriate for consequential workflows.
• Logging and traceability appropriate to the system and client requirements.
• Documentation of known limitations and operational assumptions.
• User disclosure when a person is interacting with AI where required or appropriate.
• Labeling or machine-readable marking of AI-generated or altered content where applicable to the system and required by law.

Madhi AI does not treat AI governance as a one-time launch activity. Material changes to models, prompts, tools, data sources, or decision logic should be re-evaluated before or during production use.

Organizations have different security, residency, infrastructure, and governance requirements. Madhi AI supports multiple deployment patterns depending on the sensitivity of the workflow and the client environment.

Client Cloud Deployment

AI systems can be deployed directly inside the client’s cloud environment so that application data, storage, logs, and supporting services can remain within infrastructure controlled by the client.

Dedicated Infrastructure

Dedicated environments can be provisioned for organizations requiring stronger isolation and tighter control over storage, networking, access, and logging.

On-Premise Deployment

For organizations with strict internal security or compliance requirements, systems can be deployed inside internal infrastructure where the solution architecture supports it.

Small Language Models in Client Infrastructure

For highly sensitive workflows, Madhi AI can deploy optimized small language models directly inside the client environment. This can reduce reliance on external data transfer for core processing and provide greater control over sensitive or regulated workloads.

EU / EEA Data Residency

For European residency requirements, deployments can be designed to keep specified workloads within approved EU or EEA infrastructure. Where EU-only processing is selected, controls can be applied to storage, backups, logs, model endpoints, and supporting services, with subprocessor and transfer-path review included in the deployment design.

Madhi AI designs client deployments to support applicable security, data-protection, and AI requirements based on the client’s jurisdiction, role, data, sector, and use case. Regulatory alignment is assessed per engagement; this page is not a blanket certification or guarantee of compliance with every law or framework.

GDPR & EU AI Act

For EU / EEA-facing deployments, Madhi AI can support GDPR-aligned controls such as data minimization, purpose limitation, processor terms, retention and deletion, access controls, transfer considerations, rights support, and incident response. The EU AI Act is also considered where a deployment falls within its scope. Transparency obligations for certain AI interactions and AI-generated or manipulated content are in effect, while some high-risk AI obligations have later application dates.

Madhi AI maintains a separate Privacy Policy for personal information collected through our public website and business interactions, including website forms, Google Analytics, cookies or similar technologies, marketing communications, and applicable privacy choices.

Website analytics and marketing data are governed by that Privacy Policy and the website’s cookie or privacy controls. Customer project data handled within client AI deployments remains subject to the engagement scope, contract, and data-handling controls described on this Security & Trust page.

Deployments are designed to maintain separation between customer environments and reduce the risk of cross-customer data exposure.

Typical architecture includes

• Dedicated or logically separated storage environments.
• Isolated knowledge bases or vector databases.
• Independent workflow pipelines and credentials.
• Segregated model access and provider configuration.
• Client-specific logging, retention, and deletion boundaries.

The exact isolation model is documented as part of the agreed implementation architecture.

Madhi AI follows structured data-lifecycle practices across ingestion, processing, storage, retrieval, and deletion.

• Data is ingested only for approved workflow execution.
• Data is processed within the selected secure environment.
• Data is stored only where required for system functionality, auditability, or an agreed business purpose.
• Retention periods are defined with the client and applied to relevant stores, logs, and backups where technically supported.
• Data can be deleted according to the agreed retention and termination process.

Upon contract termination, customer data can be returned or permanently deleted according to the client’s requirements, the agreed project scope, technical constraints, and applicable legal retention obligations.

AI systems may rely on cloud infrastructure, model inference, monitoring, logging, and other technology providers. Madhi AI reviews the role of these providers in the deployment and can provide relevant information during client security and privacy review.

Available or supportable documentation may include

• Data Processing Agreement (DPA).
• Security policies and procedures.
• Infrastructure and data-flow architecture overview.
• Subprocessor list and relevant provider roles.
• Data retention and deletion approach.
• Model-provider and data-retention configuration information.
• Regional hosting and transfer-path information where applicable.

A current subprocessor list can be made available during onboarding or upon request. Material subprocessor requirements, including notice or approval rights, are handled according to the applicable contract.

In the event of a suspected security or privacy incident, Madhi AI follows a structured response process appropriate to the affected deployment.

• Investigation, triage, and containment.
• Assessment of affected systems, data, customers, and likely impact.
• Preservation of relevant logs and evidence where appropriate.
• Communication with affected clients without undue delay in line with contractual and legal obligations.
• Remediation, recovery, and measures intended to prevent recurrence.
• Coordination on regulator or data-subject notifications where Madhi AI’s processor or service-provider role requires support.

For GDPR-regulated processing, controllers may have a 72-hour supervisory-authority notification window for reportable personal-data breaches, while processors must notify controllers without undue delay. Contractual incident terms are structured with these and other applicable timelines in mind.

Many organizations require security, privacy, AI-governance, and vendor-risk review before production access is granted. Madhi AI supports these reviews and can provide relevant documentation during onboarding and evaluation.

Review materials can include

• DPA and data-handling terms.
• Security policies and procedures.
• Architecture and data-flow overview.
• Subprocessor information.
• Retention and deletion approach.
• AI model/provider configuration details relevant to data handling.
• Responses to client security and vendor-risk questionnaires.

Madhi AI aims to align operational practices with widely adopted security, privacy, and AI-risk-management expectations. Any formal certification, attestation, or framework-compliance claim should be treated as valid only when explicitly documented and provided for the relevant Madhi AI service or environment.

For questions about security practices, privacy, data handling, AI governance, deployment architecture, or compliance requirements, our team can provide additional information during the evaluation process.

Contact: arun@madhi.ai