Security, AI and your data
Last updated: September 29, 2026
This document is for the person who reviews a vendor before their organization trusts it with records. The first section is our Information Security Policy: what we commit to, one line each. The rest are facts about Artificial Advantage Cloud (the “Service”) as it runs today, and we update this document when something changes. The commitments we sign are in section 13 of the Subscription Agreement and in the Privacy Policy. The current version of this document is the one published at www.artificialadvantage.com/security.
Information Security Policy
Artificial Advantage LLC commits to the following for every customer.
- Multi-factor sign-in on every administrative account we hold.
- Least-privilege access to customer data: limited to named people who need it to provide, support or improve the Service, reviewed on a schedule, and removed the day someone leaves.
- A signed personnel security policy for every person with access, before access is granted.
- Encryption of customer data in transit and at rest, and saved credentials encrypted under a key unique to each account and never visible to a worker.
- Every action we take on a customer’s account through our administrative console recorded.
- A permission gate before every worker action: the Service sorts the action under the customer’s rules, so that it runs, waits for a person’s approval, or is refused. The sorting is automatic and can be wrong; the gate reduces the risk of an unwanted action, it does not remove it.
- Remote desktops that exist for one piece of work and are destroyed with it, together with every file on them.
- Named subprocessors, each under contract and each holding a current security certification, listed in our document “Security, AI and your data” and kept current.
- A written incident procedure, and notice to affected customers without undue delay and within 72 hours of confirming a breach.
- Deletion of what a customer gave the Service and what workers produced for it, in part or in whole, within thirty days of a request.
- No training or fine-tuning of AI models on customer data, by us or by any provider we use.
This section is also a document of its own, the Information Security Policy, which we send when asked for one.
AI and data usage
The Service is built on large language models from commercial model providers. The provider in use is named in the table below, and this document changes when it does.
What reaches the AI model. The task you describe, your messages, the contents of the files you attach, screenshots of the worker’s desktop, and the instructions the Service gives the worker.
What does not reach the AI model. Your saved passwords and authenticator secrets. They are encrypted under your account’s key and typed for the worker at the moment of use, so the worker does not see them and they are not part of what the model reads. A two-factor code may be seen by the worker when it is entered.
Human oversight. Before a worker acts, the Service sorts the action under your permission settings: it runs, is held for your approval, or is refused. A held action is shown to you and does not run unless you approve it. The sorting is automatic and can be wrong; it reduces the risk of an unwanted action and does not remove it. You can watch any worker’s screen as it works, and every step is recorded. Workers can also misread or mis-enter what they see, so you review their work before relying on it.
Triggers read mail. If you set a trigger on a connected mailbox, every new message is read by the Service and judged by the model against the trigger’s description. Setting up a trigger also tests it against previous mail relevant to the trigger, to improve the trigger’s accuracy. Using triggers is optional and at your discretion.
Our own use. We use your data to provide, operate, secure, support and improve the Service. That includes people at Artificial Advantage reading task records to fix a problem or to improve how workers are instructed. We do not train or fine-tune models on it.
What we require of a model provider. No training on customer data; inputs and outputs kept only as long as running the service and abuse monitoring require; a current security certification such as SOC 2 Type II; customer data stored in the United States. Each provider’s retention period, and where it processes, are in the table.
Model training
No. Your data is not used to train or fine-tune AI models, by us or by any provider we use. This will not change without your written agreement.
Data shared with AI providers
We never sell data. To run your tasks, the Service sends your data to the model provider in the table, the way it stores your files with our cloud host. The provider works for us, under terms that keep your data confidential and limit its use to providing the service to us, and it does not train on your data.
The providers the Service runs on
Every one of them stores your data in the United States.
| Provider | What it does for the Service | Where | Certifications | What matters |
|---|---|---|---|---|
| Amazon Web Services | hosting, the database, file storage, key management, secrets, logs, and sign-in (Amazon Cognito) | Oregon, United States | SOC 1, SOC 2, SOC 3, ISO 27001 | the AWS customer agreement and its data processing addendum |
| Anthropic | the AI models | stores data in the United States; a model may run in another region to answer a request | SOC 2 Type II, ISO 27001, ISO/IEC 42001, HIPAA-ready | no training on customer data; inputs and outputs deleted within thirty days, longer only for content its safety systems flag |
| E2B | the remote desktops workers use | United States, on Google Cloud | SOC 2 Type II | desktops destroyed on shutdown or timeout; TLS in transit; encrypted at rest |
| Resend | email from the Service’s own address, for accounts with no connected mailbox | United States | SOC 2 Type II | email and logs kept up to thirty days; no training on customer data |
Microsoft is not a subprocessor. A connected mailbox stays in your own Microsoft account. Our application, a verified publisher, is permitted only to read mail, send mail, keep that permission, and see your basic profile, and you can disconnect it at any time.
Retention and deletion
Your data stays for as long as your account exists. What you gave the Service and what workers produced for you, any of it or all of it, is deleted within thirty days of your asking, and closing your account is asking. Within the Service you remove saved logins, authenticator secrets, connected mailboxes, standard operating procedures, skills, templates and triggers yourself; for a conversation with everything it produced, a file, a copy of your account’s data, or the whole account, you write to hello@artificialadvantage.com.
| What | How long |
|---|---|
| Conversations, tasks, files, worker records, your standard operating procedures, skills, templates and settings | until you ask us to delete them |
| Saved logins, authenticator secrets, mailbox tokens | until you remove them or ask |
| Server logs | thirty days |
| Database backups | fourteen days |
| Earlier versions of files | ninety days |
| A remote desktop and everything on it | destroyed when the work ends, after thirty minutes without activity, or after sixty minutes at most |
| Inputs and outputs at the model provider | deleted within thirty days, longer only for content its safety systems flag |
| Email sent from the Service’s own address | up to thirty days at the email provider |
| Billing records | as long as tax and accounting law requires |
| An account nobody has used for two years | may be deleted after we email you |
After a deletion request, backups expire within fourteen days and earlier versions of files within ninety. If your subscription ends and you do not ask for deletion, your data waits for you to come back or to ask. Through all of this we keep what law requires us to keep, what a live dispute needs, our own records of the account (the record of our operators’ actions, our correspondence with you, billing records), and information that no longer identifies you or your clients.
Certifications, compliance and insurance
Artificial Advantage holds no security certification of its own yet. We are a new company, and a SOC 2 report is on our roadmap. The Service runs entirely on the certified providers listed above.
Our controls and our contract are written to the rules that apply to insurance agencies and their service providers: the FTC Safeguards Rule under the Gramm-Leach-Bliley Act, which requires agencies to oversee service providers and bind them by contract to safeguards; the NAIC Insurance Data Security Model Law as adopted by the states, which requires the same and prompt notice of a cybersecurity event; and the California Consumer Privacy Act’s service-provider terms. Section 13 of the Subscription Agreement carries those commitments in writing and serves as our data processing agreement.
We carry technology errors-and-omissions insurance with privacy liability coverage. A certificate of insurance is available on request.