Security & Trust
Security and data protection
Your data stays yours: encrypted, isolated in your own environment, hosted in the US, and never used to train AI for others without your written opt-in.
Last updated October 2026
- Encrypted in transit and at rest
- Your own isolated environment
- Hosted on US servers
- Incident notice within 72 hours
Data protection
Encryption
Your data is encrypted while it travels (TLS) and while it's stored (AES-256).
Hosting
Managed hosting on AWS in the United States, where client data stays on US servers.
Isolation
You get your own isolated environment, enforced at the database level. No other client can reach it.
Backups and monitoring
Regular backups stored separately, continuous monitoring, and maintenance included.
Access
Role-based access
Each person sees only what their role allows. Access is permission-scoped and enforced by the system.
Support access with consent
Our team accesses your environment only for technical support, and only with your consent.
Audit trail
Consequential actions are logged: who, when, what changed and what approval was given. The log is available to you. Data-integrity and access controls are built into the architecture and reviewed by our platform team.
AI governance
The AI answers only from your approved knowledge base. It gives no open-internet answers.
Consequential actions need human approval.
When the AI is unsure, it says so and routes to a person. Sensitive questions, for example medical or legal, go to a person you designate.
Your data is never used to train models for others without your written opt-in.
Calls and messages
Your own number
A dedicated number per client. Recordings and transcripts stay in your environment.
No unsolicited outreach
No unsolicited outbound calls or messages. All automated communication follows workflows you approve.
Consent and disclosure
We configure consent and disclosure settings. You maintain consents with your own contacts.
If something goes wrong
We notify you without undue delay, and no later than 72 hours after we're notified of a confirmed incident.
- What happened
- What data was affected
- The steps we're taking to fix it
Your data, your exit
You own your data
We take no revenue share and make no claim on your data.
Full export when you leave
You get a full, machine-readable export within a 90-day window after you leave.
Hosting options
Choose where your data lives.
Our managed AWS hosting in the US
Your own isolated environment on US servers, with monitoring, backups and maintenance included.
Bring your own server
Keep your data on your own server. Responsibilities for that server are agreed in writing.
The monitoring, backups and maintenance described on this page apply to managed hosting.
Providers and certifications
Our providers
Our core providers include AWS (hosting), Twilio (voice and messaging) and Anthropic (AI models). The full subprocessor list is in our Data Processing Agreement. We never sell or share data for marketing.
Certifications
We don't hold SOC 2 or ISO 27001 today. We'll pursue formal certification when client requirements call for it. We will never claim a certification we don't hold.
Work involving health information is scoped separately (HIPAA) before any health data is processed.
Questions your IT team may ask
Where is our data stored?
With our managed hosting, on AWS in the United States, and it stays on US servers. If you choose to host on your own server, it stays there.
How is our data encrypted?
With TLS in transit and AES-256 at rest.
Can another client see our data?
No. Every client has its own isolated environment, enforced at the database level.
Who at HazirMinds can access our data?
Our platform team has access only for technical support, and only with your prior consent. Inside your organization, access is role-based and enforced by the system.
Are AI and admin actions logged?
Yes. Consequential actions are logged with who, when, what changed and what approval was given, and the log is available to you.
Is our data used to train AI models?
Not for others. Your data is never used to train models for other customers without your written opt-in.
What happens if there's a security incident?
We notify you without undue delay, and no later than 72 hours after we're notified of a confirmed incident, with what happened, what data was affected and the remediation steps.
Which subprocessors do you use?
Our core providers include AWS (hosting), Twilio (voice and messaging) and Anthropic (AI models). The full subprocessor list is in our Data Processing Agreement. We never sell or share data for marketing.
Do you have SOC 2 or ISO 27001?
We don't hold SOC 2 or ISO 27001 today. We'll pursue formal certification when client requirements call for it. We will never claim a certification we don't hold.
Do you handle health information?
Work involving health information is scoped separately (HIPAA) before any health data is processed.
Need a closer look?
Bring your IT or security reviewer. We'll walk through every control on this page.