Security
How we handle your data, and the AI tools we use on it.
Written for the security and procurement reviewers on your side. If you have a questionnaire, send it to us and we will answer it in writing.
Data handling
We take the least access we need, for the shortest time we need it.
- We work inside your cloud account or tenant where we can, so data does not leave your environment.
- Access is limited to the engineers on your project and removed when the work ends.
- We ask for samples, not full exports, and we agree the scope in writing.
- Client data is deleted at the end of an engagement, and we confirm that in writing on request.
- We do not use client data to train models, ours or anyone else's.
AI tool policy
We build with AI tools, so we are specific about how our own team uses them.
- Client data is never pasted into consumer AI tools.
- Our team uses approved tools, under business terms that exclude training on our inputs.
- Model providers used in a client system are agreed with the client and listed in the project documentation.
- AI-assisted code is reviewed by an engineer like any other code before it ships.
GDPR-aware practices
We work with European teams and design for the regulation from the start.
- A data processing agreement is available on request.
- We agree the processing region with you, and tell you which sub-processors are involved.
- We collect only the personal data a project needs, and redact it where a model does not need to see it.
- We support access, correction and deletion requests that come through you as the controller.
Engineering practice
Ordinary good practice, applied to AI systems.
- Secrets live in a secrets manager, never in code.
- Every change is reviewed by a second engineer.
- Dependencies are scanned, and updates are tracked.
- AI systems log what they did and why, so actions can be audited and replayed.
- Agents that change data or send messages stop for human approval first.
For reviewers
Quick facts.
The details a procurement form usually asks for first.
- Legal entity
- Serencia Intelligent Systems (Pvt) Ltd
- Registered in
- Sri Lanka
- Company number
- PV00377718
- Data processing agreement
- Available on request
- Sub-processor list
- Available on request, per project
- Security contact
- [email protected]
Send us your security questionnaire.
We answer in writing, and we say so plainly when something does not apply or we do not do it yet.
Email the security contact