Trust
Security & data
We're a small team, so we keep security simple and strict. Here's exactly what we do — and what we don't claim.
Your data stays in your accounts where possible
Where we can, we build inside accounts you own — your phone numbers, your AI provider keys, your CRM. If we ever stop working together, you keep everything and simply remove our access.
Access
- Two-factor authentication on every account we use for client work.
- Only the engineer working on your project has access, and only to what the project needs.
- Passwords and API keys live in a password manager or encrypted environment settings — never in code, chat or email.
Handling data
- All traffic is encrypted in transit (HTTPS/TLS). The providers we use encrypt stored data.
- We collect only the data a system needs to do its job.
- We use AI providers' business/API plans, which under their terms don't use your data to train their models. We confirm the provider's current terms with you before a build.
- Your data is never used to build or train systems for other clients.
- Where data must stay in a region (for example, patient data in the UAE), we tell you up front whether our tools can support that before you commit.
Voice and chat agents
- Callers are told when a call is recorded or handled by AI, where the law requires it.
- Agents follow rules you approve and hand over to a person for anything outside them.
- Transcripts and recordings are kept only as long as agreed in your contract.
Contracts
- NDA before you share anything sensitive — on request, at no cost.
- A data processing agreement for projects that handle personal data (UK/EU GDPR, UAE PDPL, India DPDP Act).
- At the end of a project we return or delete your data within 30 days and confirm in writing.
If something goes wrong
If we discover a security incident affecting your data, we'll tell you without undue delay — within 72 hours at the latest — with what happened and what we're doing about it.
What we don't claim
We don't hold formal certifications such as SOC 2 or ISO 27001 yet. If your project requires them, tell us early and we'll be honest about whether we're the right fit.
Report a vulnerability
Found a security issue on our site or a system we built? Email security@evolvebizai.com. We'll reply within 2 business days.