Security and AI use summary
- Each client's data is kept in its own encrypted vault, on encrypted hardware Bullsai owns.
- Record-level data, including pseudonymized rows, does not enter a third-party AI model unless the client authorizes a named provider in writing.
- No model is trained or fine-tuned on client data unless the client agreement permits it.
- Results leave the secure environment only after an automated identifier check and a principal's review. No reported statistic describes fewer than 10 records.
- Contractors build software against synthetic data and have no access to client data, client systems or encryption keys.
- Clients are notified within 24 hours of a suspected incident involving their data.
- Client data is destroyed by cryptographic erase within 30 days of engagement close, confirmed by a signed certificate of destruction (NIST SP 800-88 Rev. 2).
Controls are mapped to NIST CSF 2.0, NIST SP 800-53 Rev. 5 and the NIST AI Risk Management Framework. Bullsai does not claim certification under these frameworks. We complete client security questionnaires and will demonstrate any control on request.
The full Information Security Policy is published on this site. The AI model register and vendor list are available under a mutual NDA. Bullsai Labs carries cyber liability and technology errors and omissions insurance; a certificate is available on request. Security inquiries and incident reports: security@bullsailabs.com or 404.667.6920.
Reporting a security issue
Write to security@bullsailabs.com or call 404.667.6920 and leave a message. Our security.txt file lists the same contact for automated tools.