Security and how we handle your data

• We ask only for what the work needs, and build and test with samples or de-identified data where that is enough.
• Your data stays in your own systems wherever possible, and on our side only the people working on your project can access it.
• We never reuse your business data to train systems for other clients.
• When the engagement ends, we return or delete project data we hold if you ask, unless the law requires us to keep it.

• Accounts in your name. AI model, telephony, messaging, automation and hosting accounts are registered to your business wherever possible, with API keys issued from them.
• Least-privilege access. We ask to be added as a named user with the narrowest role that does the job, not for shared logins. You can revoke our access at any time.
• Secrets out of code. API keys and passwords live in each platform’s secret or environment settings, never in code repositories.
• Access removed at the end. When an engagement ends, we hand over admin control and remove our access. On a monthly plan, we keep only what the plan needs.

We recommend multi-factor authentication on every account involved, and we tell you promptly if we suspect something has gone wrong.

• Your system sends data to the AI providers named in your proposal, under each provider’s terms, which you can review before you accept.
• Where a provider offers a setting that keeps API data out of model training, we choose it. Where reduced or zero data retention is available to your account, we can configure it.
• If data must not leave your environment, a self-hosted model or on-premise deployment can be scoped as an Enterprise build.

This website

miniailabs.in is hosted on Cloudflare, which also runs the AI behind our site chat assistant (Cloudflare Workers AI). Resend delivers form, chat and newsletter emails, with Formspree as a backup, and Calendly handles bookings. Google Analytics sets cookies only if you accept them; Microsoft Clarity and Meta Pixel load only after you accept optional cookies.

Your project

The providers depend on what we build: usually an AI model provider plus telephony, messaging, automation or hosting. Your proposal names them, and most run on accounts in your name under your own agreement with each provider.

When a project involves health information, we build HIPAA-aware:

• the AI sees only the minimum information each task needs;
• protected health information stays in systems you control, or with providers that will sign a business associate agreement (BAA) with you;
• we can build and test with synthetic or de-identified data until your agreements are in place;
• before launch, you get a written data-flow description for your compliance advisor.

HIPAA-aware is a design approach, not a certification. Whether a system meets HIPAA, GDPR or another regulation depends on your policies, agreements and risk assessment, which we support but cannot sign off for you.

Plainly stated

• We do not hold SOC 2 or ISO 27001 certification.
• We do not claim HIPAA compliance or GDPR certification for ourselves or for what we build.
• We do not offer standard availability guarantees; a custom SLA is available on Enterprise builds.

What we can do

• Complete your security questionnaire honestly, including “no” where that is the true answer.
• Describe your system’s data flows, providers and access in writing.
• Work within your controls, such as single sign-on or an approved-vendor list, when the proposal allows for it.
• Sign an NDA, data processing agreement (DPA) or business associate agreement (BAA) on request, reviewed case by case. Raise it before work starts.

Think you have found a vulnerability in miniailabs.in or a system we operate? Email [email protected] with the subject “Security”, describing what you found and how to reproduce it. We aim to acknowledge reports within 3 business days.

Please give us reasonable time to fix the issue before telling anyone else, do not access or change data that is not yours, and do not run denial-of-service, spam or social-engineering tests. We do not run a bug bounty and cannot offer payment for reports.