AURAS INNOVATION · PRIVOID.AI

Security and Data Handling

Effective 30 September 2026 · Version 2

This page separates facts about the current marketing website from security choices that would be designed for a future client system. It is a disclosure of scope, not a security certification or a blanket promise that every proposed deployment is air-gapped, zero-egress, or free of third-party services.

1. Current website

• The public site is delivered through Sites hosting and Cloudflare infrastructure over HTTPS. Those providers can process technical traffic and security events needed to deliver and protect it.
• The current site code does not intentionally add analytics or advertising trackers. A Cloudflare bot-management cookie has been observed; see the Cookie Notice.
• The calculator computes in the browser. A copied calculator URL can disclose its parameters to anyone who receives it.
• The site currently shows an inquiry preview without form fields or a delivery endpoint. It does not collect inquiry details from that preview. The published Privoid contact address requires mailbox activation separately.

No public statement here establishes a particular log-retention period, geographic residency, penetration-test result, ISO/SOC certification, managed security service, or incident-response service level. Those facts must be verified before they are promised.

2. Before receiving client data

Do not send production datasets, passwords, source-code secrets, special-category personal data, or confidential files through this site. For a proposed engagement, the parties should sign an NDA if needed and agree a secure transfer route, minimum necessary dataset, permitted users, storage location, deletion method, and handling of backups and logs. The customer should remove or mask unnecessary personal data before a benchmark where possible.

3. Project security schedule

A real statement of work and security schedule should specify, in testable terms:

• Architecture and boundary: on-premises, isolated, cloud, or hybrid; network egress; allowed model and API endpoints; remote administration; and data-residency requirements.
• Identity and access: who provisions accounts, privileged access, authentication, approval, revocation, and audit review.
• Data protection: encryption in transit and at rest where required, key ownership, segregation, backup, retention, return or deletion, and recovery tests.
• Software assurance: dependency and licence inventory, patching ownership, vulnerability handling, testing, and change-control responsibilities.
• Monitoring and incident response: logs, alerting, escalation contacts, notice triggers and timeframes, investigation cooperation, and evidence preservation.
• Third parties: all approved model, hosting, support, and subprocessing providers; what data each receives; where it may be processed; and how changes are approved.

4. Local and hybrid systems

A local architecture can reduce exposure to external model providers, but “local” alone does not prove that data stays inside a specific physical or logical boundary. Software updates, telemetry, remote support, backups, connected tools, and user actions can create external flows. An air-gapped design requires a documented boundary and independent verification appropriate to the project. Hybrid routing may send selected inputs to an external provider only within the agreed data-flow and permission rules. A one-time network test is evidence for that test setup, not a permanent security certificate.

5. Shared responsibility and changes

The client typically controls its users, supplied data, business purpose, and deployment environment; our exact build, support, and security responsibilities must be stated in the signed agreement. A new provider, model, data type, or high-impact use case may require a revised risk and privacy assessment before deployment. We will assess incidents and make any notification required by law or contract, but this website does not set a project-specific response time.

Questions about a proposed security schedule may be sent to support@privoid.ai. See the Privacy Notice for website personal-data handling.