What happens when you give us access.
Our engagement starts by connecting to the systems your company already runs on. That is a real question and it deserves a real answer, so this page describes what we actually do — and states plainly what we do not yet hold.
We claim no certification here, and we will not imply one.
Tech-Enabled Capital does not represent that it holds a certification, audit status or regulatory designation unless we expressly state that it currently does — and no such claim is made anywhere on this site. If you are looking for a SOC 2 report or an ISO 27001 certificate, ask us directly rather than inferring one from a badge. A firm claiming otherwise is the first thing a competent diligence process finds, and one exaggerated claim contaminates everything else here.
What we can tell you is how the system is built, what it is permitted to do, and what is contractually committed in the Data Processing Addendum. Those are the commitments that matter, because they are enforceable rather than decorative.
The measures committed in the DPA.
Schedule 2 of the DPA commits us to maintaining controls appropriate to the risk of the processing, drawn from the families below as applicable to the services actually deployed. That is the contractual commitment reproduced rather than written for marketing, and it is deliberately a scope rather than an inventory. Which of these apply to your deployment, how they are implemented, and what evidence exists for them are diligence questions we answer specifically — ask them directly. A list on a page is not a control audit, and we will not present it as one.
- Governance and access. Defined security responsibilities, confidentiality obligations, access limited by job function and business need, authentication and credential controls, and timely removal of unnecessary access.
- Data protection. Reasonable protection of customer data in transit and at rest where technically appropriate, logical separation between customer environments or data, restrictions on production access, and secrets and credential management appropriate to the environment.
- Development and change management. Controlled deployment practices, code and version management, testing appropriate to the change, and rollback or recovery procedures for material production changes.
- Monitoring and incident response. Operational logging appropriate to the services, monitoring for material failures and security events, an incident-response process, and escalation and remediation procedures.
- Availability and recovery. Backup or recovery mechanisms appropriate to authoritative data and production state, recovery procedures appropriate to the services, and controlled retries and failure handling where relevant.
- Vendor management. Reasonable diligence of material subprocessors, contractual confidentiality and data-protection obligations, and review of vendor security posture appropriate to the access granted.
Access is not authority.
The strongest security property of this system is not a certificate. It is that reading a system, navigating it and preparing an action are separated from being permitted to cause the consequence.
Authorization is decided deterministically, outside the model, against an explicit execution boundary. Approval gates are placed by consequence, not by how confident a model happens to be: recoverable internal work can be highly automated, while material non-recallable external effects — moving money, refunds and charges, consequential customer or employee communication, termination, public disclosure — remain gated close to the final action.
Consequential actions are recorded — security- and decision-relevant events, and the state transitions they cause. Audit logging captures the actor, the tool, the action, the time, the approval and the failure, with enough of the input and output — by reference, hash or bounded excerpt where the content is sensitive — to reconstruct what happened rather than describe it from memory. The audit surface is deliberately intentional rather than universal, because a log that duplicates everything becomes a second unrestricted copy of your data. Rollback and recovery exist because a backup that has never been restored is an assumption, not a recovery path.
Not everything has to leave your environment.
We are deliberately model-agnostic. High-volume interpretation can run on private and local models in controlled infrastructure, which is a privacy property as much as an economic one: a workload served that way does not send its data to an external inference provider. That is a statement about where inference executes and which data crosses which boundary, not a claim that a controlled environment has no network path at all — no operated system can honestly say that. Which workloads run where, and what the data boundary around each one is, is an engagement-level decision made with you rather than a fixed answer we publish.
What we will not do with it.
- We do not sell customer data and do not use it for cross-context behavioural advertising.
- We do not pool identifiable customer data across customers.
- We do not use identifiable customer data to train generalized models.
- We do not acquire ownership of your underlying company records because our technology processes them. See Data Ownership.
On a security incident affecting customer personal data, we notify you without undue delay after becoming aware of it — not after the investigation finishes — describing the nature of the incident, the categories of data and people affected, the likely consequences, and the mitigation taken or proposed. Where we cannot give you all of that at once, you get what we have and the rest follows without undue further delay.
On exit, the choice between return and deletion is yours. Tell us within 30 days of termination and we produce the export; otherwise we delete customer personal data from active systems within 60 days. Retention past that is limited to what law requires, a then-pending dispute or claim, and ordinary backup cycles. Backup copies may persist until overwritten under normal retention, protected and not restored except for legitimate recovery.