Security, data and responsible AI

Your data is yours and we hand over the code

Your data is always yours and we hand over the code of the software we build, documented. If you stop working with us, you take it with you.

Where your data lives

We use top-tier cloud infrastructure, with data in the European Union by default. We only host it in the US if the client expressly asks, and always with GDPR safeguards.

Security by design

On every project we apply role-based access with least privilege, encryption in transit (HTTPS), automatic encrypted backups with restore tests, and secrets kept out of the code. Management applications keep an activity log of user actions.

GDPR

We process personal data in line with the GDPR. We sign a data processing agreement with every client whose personal data we process. Our privacy contact is Antonio Tripiana (info@scalability.es).

Responsible AI

Human oversight

Agents hand sensitive or out-of-scope cases over to a person.

Transparency

Voice and chat agents identify themselves as AI to the people they talk to, in line with the EU AI Act.

Client data

It is not used to train AI models, ours or anyone else's, without the client's express written consent. We work with providers that guarantee they do not train on the data sent to them.

Clear limits

Each agent can only do what the client has authorised, with test modes and an emergency stop.

Continuity

Depending on what each contract covers, applications include monitoring, error alerts, backups and support. Response times are also agreed in each contract.

Security contact

To report an incident or a vulnerability, write to info@scalability.es. It is also published at /.well-known/security.txt.