SECURITY & DATA

Define the boundary.
Build within it.

Data handling is part of the project design—not a promise made by a model name.

Agree the environment first

Document the training and deployment environment, authorized users, data locations, and permitted external services before processing customer data. Customer-controlled infrastructure and agreed cloud environments are scoped separately.

Use data for the agreed purpose

Review data rights and remove information the task does not need. Specify permitted training use, approved teacher models, and any third-party processing in the engagement. Do not upload confidential documents through the public inquiry form.

Set retention and access rules

Agree retention periods and deletion procedures for datasets, intermediate checkpoints, logs, and backups. Define access controls and encrypted transfer channels for the selected environment.

Deliver traceable artifacts

Document the source model, applicable license, dataset version, training settings, evaluation results, and deployment requirements. Artifact ownership and redistribution are defined by the project agreement and underlying licenses.

Private and confidential are different

Local execution can support a customer-controlled data boundary. Hardware-backed confidentiality additionally requires compatible hardware, validated isolation, attestation, and controlled secret release. Fine-tuning alone does not provide these protections.