Start with one workflow →
Security, data and deployment

Hosting location does not settle who can access data.

We document control in six layers and agree each one in the contract.

  1. L1

    Deployment boundary.

    Production, backup, model-provider, log, telemetry and disaster-recovery locations documented.

  2. L2

    Operator access.

    Client-approved accounts; least privilege; multi-factor authentication; time-limited access; session logging where appropriate; no shared production credentials.

  3. L3

    Development data.

    Synthetic or minimised test data. We do not assume de-identification removes privacy obligations.

  4. L4

    Training and retention.

    No training or product improvement on customer data unless explicitly authorised; model-provider handling, retention and deletion specified.

  5. L5

    Contracting and IP.

    Written scope; confidentiality; foreground and background IP; subcontractors; termination assistance; approved data flows.

  6. L6

    Restricted work.

    Sector, geography and procurement restrictions checked before access is accepted. We decline work the proposed model cannot lawfully or operationally support.

Deployment options

Client-hosted.

Software and artefacts run in your cloud, with controlled supplier access.

Managed tenant.

An isolated service with agreed providers and controls.

No-production-access engineering.

We build on synthetic data; you operate production.

Per-engagement documents

Every engagement produces a data-flow diagram, a threat model, and a model and provider register. They are yours.

Reference frameworks

We use NIST AI RMF, the OWASP Top 10 for Agentic Applications and ISO/IEC 42001 as reference frameworks for our method. Using a framework is not certification against it; see Trust and compliance for what is held.

Trust and compliance →

Cross-border note

The European Commission's adequacy decisions do not list Pakistan as of this review. That does not by itself prohibit a transfer, but a lawful mechanism and an assessment may be needed. Your counsel determines the applicable obligations. This page is an engineering and procurement checklist, not legal advice.

Reporting a vulnerability

info@chainfore.com.