Security and privacy
How we protect your data
When you let an AI system work on your documents, the first question is the right one: where does my data go, and who can see it? Here is our answer for every system we build.
Only approved AI models
We use AI models from an approved list, never whatever tool is handy. A model is approved only if it meets all of these:
- Business-grade terms. We use the enterprise or API service, not the consumer app. Under those terms the provider does not use your data to train its models.
- Known retention. We know how long the provider keeps a request, if at all, and we pick the shortest setting available.
- Independent audits at the provider. The provider's own infrastructure is independently audited, for example with SOC 2 Type II or ISO 27001 reports, and we can share those reports with you.
- A choice of region. Where you need it, data is processed in a region you choose, such as Canada or the US.
- You approve the models. You approve which models touch your data before we start. To keep everything inside your own environment, we can run an open-weight model privately in your cloud account or on your own server. Free and consumer AI tools are never used with client data.
Your data is never used for training
Your documents are used for one thing: doing your work.
- No training. They are not used to train or improve any AI model, ours or a provider's.
- No shared datasets. We don't build datasets from client material, and nothing from one client is ever used for another.
Your data stays private
- Never public. Client data is never published, shared, or reachable from the open internet. It isn't pasted into public chat tools or kept on personal devices.
- Encrypted in transit and at rest. Data moves only over encrypted connections between your systems and the approved model service, and it is encrypted wherever it's stored.
- Your accounts where possible. We prefer to build inside accounts you own and control: your Microsoft 365, Google Workspace or cloud tenant. You keep the keys and can switch our access off at any time.
- Least access. The system and our team get only the access the work needs, read-only wherever that's enough, and access is removed when the work ends.
- Kept only as long as needed. Working copies are deleted or returned when the engagement ends, as agreed with you in writing.
People stay in charge
- A person approves every action that matters. Nothing is filed, sent, deleted or changed without someone saying yes.
- When unsure, it asks. Anything the system isn't confident about is set aside for a person. It is never guessed.
- Every step is logged. What came in, what the system proposed, who approved or changed it, and when. You can review it at any time.
- Stop at any time. Every system can be paused or switched off, and your work carries on the way it did before.
Guardrails built in
- Defined boundaries. Each system can reach only the folders, mailboxes and tools named in its scope.
- Protection against manipulation. Text inside a document is treated as content, never as an instruction, so a document can't tell the system to do something it shouldn't.
- Sensitive details handled with care. Personal identifiers can be masked or left out wherever the work doesn't need them.
- Tested before it goes live. We test each system on agreed samples, with results you can check, before it handles real work.
The standards we follow
We design and run our work using the practices behind recognised security and privacy frameworks, including SOC 2 (security, availability and confidentiality controls), GDPR (data minimisation, purpose limitation, the rights of the people the data is about) and HIPAA (safeguards for sensitive personal information), along with Canada's PIPEDA and the confidentiality rules of your profession. These are practices we follow, not certifications we claim. Where you need a certified party, the certification belongs to the model and cloud providers we use, and we'll show you their reports.
If something goes wrong
If we ever find a problem that affects your data, we tell you promptly, explain what happened and what we know, stop the affected system if needed, and work with you on the fix. Your contract sets out the details.
Ask us anything
On request, we'll give you the list of providers that would handle your data, their audit reports, and a written description of how your system is set up. Email hello@visionzlab.com.
This page covers the AI systems we build for clients. For this website itself, see our privacy notice. Last updated 2026-11-04.
Questions
Is our data used to train AI models?
No. We use only business-grade AI services whose terms exclude training on customer data, or open-weight models run privately in your own environment. Your documents are used only to do your work.
Which AI models do you use?
Models from an approved list: enterprise services from major providers with no-training terms, known retention and independent audits, or a private open-weight model. You approve which ones touch your data before we start.
Is VisionzLab SOC 2 or HIPAA certified?
No. We follow the practices behind SOC 2, GDPR, HIPAA and PIPEDA in how we design and run systems, but we don't claim those certifications. The model and cloud providers we use hold their own, and we can share their reports.
Can the AI act on its own?
Not on anything that matters. It proposes, a person approves, and every step is logged. Anything it isn't sure about goes to a person.
Can we keep everything in Canada?
Where you need it, we choose services that process data in Canada, or run the system inside your own cloud account in a Canadian region.
Not sure where to start?
Request a free discovery session. We'll look at your work together and tell you plainly where AI would help — and where it wouldn't.