Trust center
Trust center: what we do, and what we are not
MiniAI Labs is a founder-led AI engineering studio. We hold no security certifications, so this page shows what stands behind every build instead: how we protect your data and systems, how the AI is kept in check, and how we support your own review.
Security
Defence in depth for the systems we build: your data at the core, then accounts in your name, least-privilege access, secrets out of code, and our access removed at the end.Data
Used only for your project, never to train systems for other clients, and returned or deleted on request when we finish.AI safety
Six stages from scope to response: guardrails, testing before launch, human approval for consequential steps, monitoring, and a plan for when something goes wrong.Transparency
Who is responsible for what in an AI project: data, accounts, models, channels and compliance, split between your team and ours.
Control map
What we do, pillar by pillar
Security
Accounts registered to you
The model, telephony, messaging, automation and hosting accounts behind your system belong to your business wherever possible. We work inside them; we do not own them.
Scope: Every build, unless your proposal names an exception.
Named, narrow access
We join your tools as named users with the smallest role that works, never through a shared login, and you can remove us without asking.
Scope: Your systems and the provider accounts we set up for you.
Keys in secret settings
Credentials sit in each platform’s secret or environment settings and are issued from your accounts, so none of them lives in a code repository.
Scope: Test and production credentials alike.
Data
Purpose-bound use
We access and use what you share only to deliver and support your project, and we limit access to what that work needs.
Scope: Project data, as set out in section 10 of our terms.
No cross-client training
Nothing you give us becomes training material for another client’s system. Where an AI provider offers a training opt-out for API data, we turn it on.
Scope: Our work, plus the provider settings we control.
Return or delete at the end
When the engagement closes, the project data we hold goes back to you or is deleted, whichever you ask for, unless a law requires us to keep it.
Scope: Copies we hold; your own systems stay under your control.
AI safety
Retrieved text is data, not instructions
Documents, emails and web pages an assistant reads reach the model as quoted data, never as instructions, and text that looks like a hidden command is flagged. This reduces the risk of prompt injection; it does not remove it.
Scope: Assistants and agents that read content they did not write.
People approve consequential steps
An agent can draft a refund, a booking change or a record update, but by default a person in your team approves anything that is hard to undo.
Scope: Agents and automations with write access to your systems.
Unsure means a person takes over
When an assistant has no good source for an answer, it says so and offers a handoff with the conversation attached, instead of guessing.
Scope: Chat and voice assistants, including the one on this site.
Transparency
AI that says it is AI
The assistant on this site introduces itself as an AI, and the chat and voice agents we build disclose it by default. Your business decides any further disclosure its market requires.
Scope: Every channel that talks to the public.
Labels on every example
Worked examples are tagged Concept build, systems running on this site In-house build, and demos Sample data. We never name a client or show a project without written permission.
Scope: Pages, cards and videos on miniailabs.in.
Typical targets, never promises
Any outcome figure on this site is a typical target with its basis stated. We do not guarantee business results such as revenue, leads, savings or resolution rates.
Scope: Marketing pages, proposals and the chat assistant’s answers.
Detail
The details behind the map
What we are not
Enterprise vendors often open with a row of badges. We do not have them, and we would rather you read that here than discover it halfway through procurement.
- We do not hold a SOC 2 attestation or an ISO 27001 certificate.
- We do not claim HIPAA compliance or GDPR certification, for ourselves or for what we build. Builds that touch health data are HIPAA-aware by design.
- We do not publish penetration-test results.
- We do not offer standard availability guarantees. A custom SLA is available on Enterprise builds.
- We are not a SaaS platform with a shared tenant: each system runs in accounts set up for that client.
- We are not a large security organisation with an operations centre. We are a founder-led studio, and the practices on these pages are sized to that honestly.
None of this rules out a careful review. It means the review looks at how your system is actually built, which is what a badge stands in for anyway.
How we support your security review
- We complete your security questionnaire or vendor-assessment form honestly, including “no” where that is the true answer.
- We describe your system’s data flows, providers and access in writing.
- We work within your controls, such as single sign-on or an approved-vendor list, when the proposal allows for it.
- We sign an NDA, data processing agreement or business associate agreement on request, reviewed case by case. Raise it before work starts.
- Formal tenders follow the same path: send the RFP and any questionnaire together with a short description of the project.
Who is responsible for what
Security in an AI project is shared. We design, build, configure and hand over; you own the accounts, the data and the decisions about what your business must disclose; the AI and infrastructure providers run their platforms under their own terms. The shared responsibility page sets out the split layer by layer, in the same terms as our contract.
| Layer | MiniAI Labs | You | Providers |
|---|---|---|---|
| Data | Uses it only for your project | Own it and confirm you may share it | Process it under their terms |
| Accounts | Set them up in your name | Hold admin rights and billing | Secure their platforms |
| AI output | Guardrails, tests and a human handoff | Review output before relying on it | Run and update the models |
| Compliance | HIPAA-aware builds, written data flows | Decide what the law requires of you | Offer agreements such as a BAA |
Providers behind this website
This site runs on a short list of providers. The privacy policy explains what each one receives and links to its own policy.
| Provider | What it does here | When it runs |
|---|---|---|
| Cloudflare | Hosting, content delivery and the server functions behind forms and chat | Every visit |
| Cloudflare Workers AI | Writes the assistant’s replies and the draft plans on the tools page | When you chat or generate a plan |
| Resend | Delivers form, chat-handoff and newsletter emails | When you send a form or subscribe |
| Formspree | Backup form delivery | Only if the main email path is down |
| Google Calendar and Google Meet | Holds booked calls, sends the invitation and hosts the video call | When you book a call |
| Google Analytics | Site analytics in consent mode | Cookieless pings until you accept optional cookies |
| Microsoft Clarity | Heatmaps and session recordings | Only after you accept optional cookies |
| Meta Pixel | Advertising measurement | Only after you accept optional cookies |
On client projects the list depends on what we build, usually an AI model provider plus telephony, messaging, automation or hosting. Your proposal names every provider, and most of them run on accounts in your name under your own agreement with each one.
Reporting a vulnerability
If you find a security issue in miniailabs.in or a system we operate, write to hello@miniailabs.in with “Security” in the subject line. The full disclosure policy, including what we ask of researchers, is on the security practices page, and the same contact is listed in our security.txt file.
Who you contract with
Proposals, contracts and tax invoices are issued by the business named below, under our terms of service and Indian law. A proposal or Enterprise contract can add security measures or a data processing agreement for your project, and it says so plainly when it does.
MiniAI Labs is a trading name of Mohamed Raffiq SR (sole proprietorship), GSTIN 33ARRPM6216E1ZS.
FAQ
Frequently asked questions
Why does a small AI studio publish a trust center?
Because buyers ask the same questions whatever the size of the vendor: where the data goes, who can reach it, what the AI is allowed to do and what happens when it is wrong. Writing the answers down once, with the gaps stated, saves both sides a round of emails and lets your reviewers see the practices before the first call.
Can you fill in our vendor security questionnaire?
Yes. Send it with a short description of the project. We answer each question as things stand today, mark the ones that depend on your project’s design, and say no where no is the true answer. A data-flow description and the provider list for your system usually answer the follow-up questions.
What should we ask any AI vendor before sharing data?
Five questions cover most of the risk. Where does our data go, and which providers touch it? Is any of it used for training, by the vendor or the providers? Who on the vendor’s side can access it? What is kept, for how long, and how is it deleted? Whose name are the accounts in when the project ends?
Is contracting with a sole proprietorship a risk for us?
It changes what you check. The contract is with the proprietor named on this page, liability follows our published terms, and a proposal can add commitments for your project. What reduces dependency is structural: your system runs on accounts in your name, you own the deliverables once paid, and another developer can maintain them.
What happens to our system if MiniAI Labs stops trading?
It keeps running. The accounts, keys and billing are in your name, so nothing is switched off with us. Once you have paid in full you own the deliverables, and our terms give you a permanent licence to the reusable parts inside them, so another developer can take over maintenance.
Where are your contractual commitments on data and security written?
In our terms of service: confidentiality is section 9, data and privacy section 10, AI output section 11 and limitation of liability section 12. The privacy policy covers this website. Anything specific to your project, such as a data processing agreement, goes into the proposal so it binds that engagement.
How do you keep these pages accurate?
We change them when a practice changes, not on a calendar, and each page records the date of its last real change in its metadata. If something here does not match what you see in a proposal or in our terms, tell us: the contract governs, and we will fix the page.
Questions about this page
For a security review, a questionnaire or anything on these pages, email hello@miniailabs.in. Tell us what you are evaluating and we will point you to the right page or answer directly.
Next step
Have a workflow in mind? Let’s scope it together.
Book a free 30-minute strategy call. Bring one process you want to automate and we will talk through scope, integrations and a sensible first step.
Free 30-minute call · no commitment