Data handling
Where your data goes. In plain words.
Most small businesses hesitate on AI for one reason: they don't know where their information ends up. This page answers that without making you read a policy document — and it says honestly what I'm not claiming.
Your systems stay yours
Wherever it's possible, what I build runs inside your own accounts — your cloud, your database, your inbox, under agreements you already hold. I get the access an engagement needs and nothing more, and that access ends when the engagement does.
Your data is never used to train AI
The AI I build on does not train on data sent through its API. Your documents, customers, and records are used to do your work and nothing else — not to improve a model, not to build a product, not to help another client.
Least data, not most
I design so that the smallest amount of sensitive information moves the shortest distance. Where a system can work on a redacted or de-identified copy, that's what it works on. Where a build can happen against sample data instead of live records, that's how it's built.
You get the keys
At handover you receive the accounts, the code, the documentation, and the ability to switch it all off without me. No hostage-taking, and nothing that only works while I'm around.
Who else touches it
These are the services this website and my own business run on. A system I build for you may use a different, smaller set — usually services you already pay for. You'll get that list in writing before anything is built.
| Service | What it does | What reaches it | Where |
|---|---|---|---|
| Vercel | Website and application hosting | Page requests, form submissions in transit | United States |
| Supabase | Database and client-portal login | Client name, company, email, project and invoice records | United States |
| Anthropic | AI processing for the site demos and for systems I build | Text submitted to a demo; in client builds, only what that workflow requires | United States |
| Stripe | Card payments | Payment details, handled entirely by Stripe — I never see card numbers | United States |
| Resend | Sending email (enquiry replies, proposals, receipts) | Recipient address and message contents | United States |
If your industry is regulated
Health care, schools, and anyone handling customer credit information carry obligations that extend to their vendors. Here is how I work with each.
Health information (home care, medical offices)
A provider handling patient information is a Covered Entity under HIPAA, and any vendor processing that information on their behalf is a Business Associate — which requires a signed agreement before anything begins. My default is to build so that patient information never leaves your environment at all: the system runs in your accounts, under the agreements you already have with your cloud provider. Where an engagement genuinely requires me to handle it, we execute a Business Associate Agreement first, reviewed by your counsel.
Student records (charter and private schools)
Student education records are governed by FERPA, and New York schools additionally fall under Education Law §2-d, which is stricter and carries its own vendor requirements including a data security and privacy plan. Schools typically require a Data Privacy Agreement — often the national standard agreement — before work starts. Same default applies: build inside your environment so student data stays within your control.
Customer financial information (dealerships, finance offices)
Auto dealers arrange financing, which makes them financial institutions under the GLBA Safeguards Rule — including an obligation to oversee their service providers. Credit applications and Social Security numbers deserve the strictest handling of anything on this page. I'll work within your written information security program rather than around it, and I'm happy to complete your vendor security review.
What I don't claim
I am a one-person engineering firm, not an audited enterprise vendor, and I'd rather you hear that from me than discover it later. I hold no SOC 2 report. There is no such thing as a "HIPAA-certified" consultant — any vendor showing you that badge is telling you they don't understand the rule. What I offer instead is a plain answer to every question on this page, an architecture that keeps your data in your hands, and a willingness to sit through your vendor review and answer it honestly.
About the demos on this site
The live demos run on samples I wrote, not on anything you upload — there is deliberately no way to send me a real document through this website. The one exception is the assistant demo, which reads a public web page you name. Nothing from a demo is stored.
Security questions welcome — that's a good sign, not an obstacle. sales@docucloud.solutions