Security practices for the AI systems we build

How we handle your data

The safest data is data we never receive. Most of what we build reads from your systems in place: a chatbot answers from your published pages, an automation moves a record between your tools. When we need a copy to build or test, we start from samples or de-identified data and ask for real records only when the work cannot be checked without them.

Access and accounts in practice

Accounts in your name are the layer that protects you from us. If we stop working together, or if anything about our own setup were ever compromised, your system keeps running on your accounts and your keys, and you can remove our access yourself. We recommend multi-factor authentication on every account involved, and we tell you promptly if we suspect something has gone wrong.

AI providers and model training

• Your system sends data to the AI providers named in your proposal, under each provider’s terms, which you can review before you accept.
• Where a provider offers a setting that keeps API data out of model training, we choose it. Where reduced or zero data retention is available to your account, we can configure it.
• If data must not leave your environment, a self-hosted model or an on-premise deployment can be scoped as an Enterprise build.

Healthcare and other regulated data

When a project involves health information, we build HIPAA-aware:

• the AI sees only the minimum information each task needs;
• protected health information stays in systems you control, or with providers that will sign a business associate agreement (BAA) with you;
• we can build and test with synthetic or de-identified data until your agreements are in place;
• before launch, you get a written data-flow description for your compliance advisor.

HIPAA-aware is a design approach, not a certification. Whether a system meets HIPAA, GDPR or another regulation depends on your policies, agreements and risk assessment, which we support but cannot sign off for you.

How we run our own site

miniailabs.in follows the same habits. It is served over HTTPS only, with strict transport security, and its response headers stop content-type sniffing, limit the referrer data sent to other sites, switch off camera, microphone and location access, and stop other sites from framing our pages. No API key reaches your browser: the chat assistant and every form call our own server functions, which validate what they receive and apply per-visitor rate limits. The assistant removes card numbers, ID numbers and passwords from messages before anything is stored or sent to a model, and it treats retrieved text as data, never as instructions.

If something goes wrong

1. We tell you promptly when we suspect a security incident affecting data we handle for your project, without waiting for the full picture.
2. We explain what happened, which data and systems were involved, and what we are doing about it.
3. We give you the information you need for your own notification duties, for example under India’s Digital Personal Data Protection Act, 2023 or the GDPR.
4. Because your accounts are in your name, you can revoke our access or rotate a key yourself at any moment, without waiting for us.

Responsible disclosure

Think you have found a vulnerability in miniailabs.in or a system we operate? Email hello@miniailabs.in with the subject “Security”, describing what you found and how to reproduce it. A person replies as soon as we can. The same contact is published in machine-readable form at /.well-known/security.txt, following RFC 9116.

Please give us reasonable time to fix the issue before telling anyone else, do not access or change data that is not yours, and do not run denial-of-service, spam or social-engineering tests. We do not run a bug bounty and cannot offer payment for reports.

Certifications we do not hold

We hold no SOC 2 report and no ISO 27001 certificate, we do not claim HIPAA compliance or GDPR certification, and we do not offer standard availability guarantees; a custom SLA is available on Enterprise builds. The trust center overview explains how we support your review without them.