Our Security Philosophy
At InstAI, security isn't an afterthought—it's the foundation of everything we do. We understand that 95% of AI implementations fail, and data security failures are a major contributor. Our "Clarity Before Action" approach ensures data protection is built into every phase of AI implementation.
Core Principle: We classify and protect your data BEFORE any AI processing begins. No exceptions.
How We Protect Your Data
🔐
Data Classification First
Before AI touches your data, we classify every piece: public, confidential, attorney-client privileged, trade secrets. Only appropriate data goes to appropriate AI systems.
🛡️
Private AI Deployment
Sensitive data never sent to public AI systems. We use API-based AI with no-training guarantees, or self-hosted AI that never leaves your infrastructure.
📋
Complete Audit Trails
Every AI interaction documented. Know exactly what data was accessed, when, by which system, and for what purpose. Full transparency.
🔒
Encryption Everywhere
Data encrypted in transit (TLS 1.3) and at rest (AES-256). Secure key management with regular rotation. Zero-knowledge architecture where possible.
👥
Access Controls
Role-based access control (RBAC). Multi-factor authentication required. Principle of least privilege enforced. Regular access audits.
🔍
Regular Security Audits
Quarterly security reviews. Penetration testing. Vulnerability scanning. Immediate remediation of identified issues.
AI-Specific Security Measures
1. Three-Tier AI Deployment Model
We implement AI using a tiered approach based on data sensitivity:
Tier 1: Public AI (ChatGPT, Claude Web)
- Use Case: General research, publicly available information
- Data Allowed: Only information already public or non-sensitive
- Protection: No client names, no proprietary processes, no confidential data
- Risk: Low (data may be used for training)
Tier 2: API-Based Private AI
- Use Case: Internal business processes, confidential but not privileged data
- Data Allowed: Client-confidential information with proper agreements
- Protection: API access only, no web interface, contractual no-training guarantees
- Risk: Medium-Low (data not used for training, but leaves your infrastructure)
Tier 3: Self-Hosted AI
- Use Case: Highly sensitive data (legal privilege, trade secrets, regulated data)
- Data Allowed: Everything, including most sensitive information
- Protection: Runs entirely on your infrastructure, data never leaves your network
- Risk: Very Low (complete control, but requires more resources)
⚠️ Important: We NEVER send privileged, regulated, or highly sensitive data to public AI systems. If you're unsure about data classification, we help you determine the appropriate tier before any processing begins.
2. Prompt Injection Protection
We protect against malicious prompts attempting to extract sensitive information:
- Input validation and sanitization on all AI queries
- Context isolation between different data classifications
- Output filtering to prevent sensitive data leakage
- Regular testing against known prompt injection techniques
3. AI Model Security
When training or fine-tuning AI models:
- Training data audited for sensitive information before use
- Models stored securely with access controls
- Version control and rollback capabilities
- Regular testing for data memorization and leakage
Infrastructure Security
Cloud & Hosting
- Providers: Enterprise-tier providers (AWS, Azure, Google Cloud) with ISO 27001, SOC 2 certification
- Data Residency: Data stored in your preferred geographic region (UK, EU, US options)
- Backups: Automated daily backups with 30-day retention, encrypted and geographically distributed
- Disaster Recovery: Tested recovery procedures with <4 hour RTO for critical systems
Network Security
- Virtual Private Cloud (VPC) isolation
- Firewall rules limiting traffic to essential services
- DDoS protection and rate limiting
- Intrusion detection and prevention systems (IDS/IPS)
- VPN access required for sensitive systems
Application Security
- Secure development lifecycle (SDL) practices
- Code review and static analysis for vulnerabilities
- Dependency scanning and automatic security updates
- Web Application Firewall (WAF) protection
- Regular penetration testing by third parties
Compliance & Certifications
Data Protection Regulations
We help clients comply with:
- GDPR (EU): Data processing agreements, data subject rights, privacy by design
- UK GDPR: UK Data Protection Act 2018 compliance
- CCPA (California): Consumer privacy rights and disclosure requirements
- Industry-Specific: HIPAA (healthcare), SOX (financial), attorney-client privilege (legal)
Security Frameworks
Our practices align with:
- ISO 27001 Information Security Management
- NIST Cybersecurity Framework
- CIS Critical Security Controls
- OWASP Top 10 Web Application Security
Client-Specific Security
For Law Firms
- Attorney-client privilege protection protocols
- Ethical wall implementations for conflict management
- Compliance with Bar Association guidelines on technology
- Separate systems for privileged vs non-privileged data
For Accounting Firms
- Client financial data segregation
- SOX compliance for financial reporting
- PCI DSS compliance when handling payment information
- Audit trail requirements for professional standards
For Consulting Firms
- Client confidentiality agreements enforced
- Chinese wall implementations between competing clients
- Intellectual property protection for methodologies
- Trade secret classification and protection
For Coaches
- Client privacy for sensitive personal information
- GDPR compliance for international coaching clients
- Secure storage of client session notes and progress
- Data portability for client ownership of their journey
Third-Party Vendors
We carefully vet all third-party services used in AI implementations:
AI Service Providers
- OpenAI (GPT-4, GPT-4o): Enterprise API with no training on your data
- Anthropic (Claude): API access with contractual data protection
- Google (Vertex AI): Enterprise deployment with data residency controls
- Open Source Models: Self-hosted on your infrastructure when needed
Integration Partners
- All vendors undergo security assessment
- Data Processing Agreements (DPAs) required
- Regular vendor security audits
- Immediate notification of any vendor security incidents
Incident Response
Security Incident Protocol
In the unlikely event of a security incident:
- Detection & Containment (0-2 hours): Immediate isolation of affected systems
- Assessment (2-8 hours): Determine scope and impact of incident
- Notification (8-24 hours): Inform affected clients and authorities as required
- Remediation (1-7 days): Fix vulnerabilities and restore normal operations
- Post-Incident Review (7-14 days): Document lessons learned and improve procedures
Client Notification
We will notify you within 24 hours if:
- Your data may have been accessed by unauthorized parties
- A security vulnerability affects your AI systems
- A vendor we use experiences a significant security incident
- We detect suspicious activity related to your account
Employee Security
Team Training
- All team members complete security awareness training
- Annual refresher training on emerging threats
- Specific training on AI security and data protection
- Regular phishing simulations and security drills
Access Management
- Background checks for all employees with client data access
- Confidentiality agreements (NDAs) with all team members
- Access revoked immediately upon termination
- Regular access reviews and permission audits
Client Responsibilities
Security is a shared responsibility. We ask clients to:
- Use strong, unique passwords and enable MFA
- Classify their data accurately before AI processing
- Report security concerns immediately
- Keep their systems and browsers updated
- Follow our guidance on which data to send to which AI tier
- Review and approve data classification decisions
- Maintain their own backup procedures as primary owner
Ongoing Security Improvements
Security is never finished. We continuously improve through:
- Monthly: Security patch updates
- Quarterly: Security audits and penetration tests
- Annually: Full security framework review
- Continuous: Threat intelligence monitoring
- Immediate: Response to new vulnerabilities or threats
Questions About Our Security?
We're transparent about our security practices because your trust is essential. Common questions we answer:
- Can you provide a detailed security questionnaire response?
- Do you have SOC 2 certification? (In progress, ETA Q2 2025)
- Can you sign our security addendum?
- What happens if there's a data breach?
- How do you handle right-to-be-forgotten requests?
- Can we audit your security practices?