Security and data handling
Your data, and who touches it.
We work inside your environment, under the access your security team grants. This page is written to be forwarded.
Commitments
How we handle your data.
- 01A confidentiality agreement first. Signed before anyone on our side touches your data, binding both of us.
- 02Your data stays yours. Kept separate from other clients' data, and returned or destroyed at your direction.
- 03Access scoped to what the work needs. Held only by the consultants staffed on your engagement, and gone when they roll off.
- 04In your environment. Changes go through your code review, your CI, and your definition of done.
- 05We never train on your data, and never on PHI. We build our own designs, agents, harnesses, skills, and processes, and improve them using our own internal development work. Never customer data, never PHI.
- 06Governed means built on your access controls, with data lineage, versioned models, and logged predictions.
- 07Handover is in scope. Documentation, runbooks, the evaluation set, the monitoring, and its thresholds, and model documentation written to your standard.
Questions from your security team go to Shaun Applegate-Swanson, Co-Founder: shaun@transmutedata.com
Our posture
- We hold no HIPAA attestation of our own — we work inside your governed environment, under your BAA.
- Named individuals provided to your security team before any access is granted.
- For regulated work, we can staff the engagement with U.S. citizens.
- Work delivered through a partner follows that partner's agreement.
A 30-minute call, on one problem you name.
Shaun takes the call. Bring your security questions to it.