Trust Center
Make boundaries, controls and responsibilities explicit.
How to examine trust in the system: first the boundaries, then the controls, then the responsibilities, then the evidence.
Security is not a blanket promise: it is a set of mechanisms whose scope and status can be examined separately, page by page.
Verification pages
Confidentiality
What data actually enters the system?
Data · Boundaries · Isolation
Traceability
Which regulations may apply, and how should they be assessed?
Rules · Roles · Evidence
The journey of a data item.
- Input
- Processing
- Simulation
- Result
- Retention / deletion
Six families of controls.
- Identity
- Who has access, with what authentication.
- Access
- Which rights, over what scope.
- Encryption
- In transit and at rest.
- Logging
- What is recorded and retained.
- Incidents
- Detection, assessment, notification.
- Recovery
- Backup and recovery of the environment.
Security is never the responsibility of a single actor.
Data
Client
Selects the data provided.
Imagine All The People
Processes the data within the defined environment.
Infrastructure / third parties
Hosts the data according to the selected foundation.
Configuration
Client
Approves the selected scope.
Imagine All The People
Configures the environment and its controls.
Infrastructure / third parties
Provides the available technical options.
Operations
Client
Manages its own access.
Imagine All The People
Operates the application environment.
Infrastructure / third parties
Operates the underlying platform and its own safeguards.
Final decision
Client
Makes the decision and assumes responsibility for its use.
Imagine All The People
Provides a result, never a decision.
Infrastructure / third parties
Not applicable.
Site, sign-up, application
Three distinct scopes.
Public site
Navigation and forms.
Sign-up
Creation of a free account and automatic sending of an invitation by email, operated by our account management service.
Application
Your questions, your documents and the synthetic populations.
The guarantees described in this section apply to the application and the environments we operate.
What a client should be able to ask to examine.
Architecture description
Controls description
Data-flow description
Use-governance framework
Regulatory mapping by use case
Details of the available elements, their status and the conditions under which they can be shared are provided on the relevant pages.
AI agents
Connecting an agent also means defining what it can send and use.
An agentic integration must specify the data sent, the capabilities available and the processing conditions.
The scope depends on your architecture, your deployment mode and the services actually enabled.
Understand the deployment optionsReducing risk does not eliminate risk.
Dedicated ≠ invulnerable
A dedicated environment reduces exposure; it does not eliminate it.
Encrypted ≠ inaccessible
Encryption protects against unauthorized access, not authorized access.
Auditable ≠ audited
A mechanism that can be examined has not necessarily been examined by a third party.
Documented ≠ compliant by definition
Compliance depends on the context of use, the actual data and the applicable contract.
Your next decision
Which decision do you want to explore?
Describe your need. We can point you to the right level of support.
