Where your data lives, and who can see it.
Security, data and compliance in plain terms. You can hand this page to whoever runs security at your company.
You own your data, wherever it lives.
We can set everything up in accounts in your company's name, or host and run it for you. Either way, the system is yours.
- Your AI platform account. Including everything it stores.
- Your operating, billing and e-signature systems. Connected, never handed over to us.
- Your forms and project mailboxes. Even the ones we create for the build.
- 01Nothing trains on your data. Not anyone's product, including ours.
- 02Protected data is masked before it reaches a model.
- 03Access is scoped per job, never granted in bulk.
- 04Every account uses multi-factor login where it is offered.
- 05Anything that needs judgment goes to a person.
What never reaches a model.
Payment details, credentials, and anything the job does not need are never in the prompt at all.
- 01Masked first.Protected data is masked or de-identified before the model is called.
- 02The model does its step.It sees what that step needs, and nothing else.
- 03Re-joined on your side.The identifying values are put back on your side of the line.
Three promises we put in writing.
The commitments a security team usually asks about first.
From our information security policy. A copy is available on request.
Three levels of secure AI.
We pick the option your data calls for, and walk you through what is read, written and sent before anything runs on real data.
If we part ways, it keeps running.
Nothing to get back from us, and nothing that stops working.
- 01Accounts stay yours.Anything already in your name stays in your name.
- 02Hosting transfers.Moved to your account without downtime or reconfiguration.
- 03Code goes to you.A private repository you are given access to.
- 04Access is removed.Every login we held is closed, and anything running under ours moves to yours.
- 05Keys are rotated.Admin tokens and mailbox passwords change at handover.
- 06It is all written down.A record of everything handed over, and when.
Access and accounts.
Who will have access to our systems?+
Gray Stecher, the founder. If a contractor ever joins a project, you are told their name before they get access, and they sign the same confidentiality and security terms we do.
How is access granted?+
By you, on accounts you own, and only for what the job needs. We prefer a named user or a service account you can switch off at any time.
How are passwords and keys kept?+
Every password is unique and kept in an encrypted password manager. Keys live only in the settings of the running system, never in documents or email.
Is our data used for testing?+
Made-up or de-identified records wherever possible. When real records are needed, we use the smallest set that proves the system works.
Compliance, in plain terms.
Are you SOC 2 or ISO 27001 certified?+
No. We do not host your data, so there is no Tesray platform to audit. Your data lives on the platforms in your own accounts, and we only build on platforms that publish their own SOC 2 or ISO 27001 reports. We can point you to each one.
Can you work with health data under HIPAA?+
Yes. HIPAA has no certification, so here is what we do: we sign a business associate agreement, build on services covered by your own agreement with that vendor, and keep the data inside your cloud account.
Will you sign an NDA or a data processing agreement?+
Yes. We have our own, or we will review yours.
Which outside tools can see our information?+
Only the ones the work needs, and we tell you before adding one. Today that means our email and documents, the AI providers we build with (test records only), our code repository (no customer records), our hosting provider until a system moves to your account, and our password manager.
Do you sell or share our data?+
No. It is used only to deliver the work.
If something goes wrong.
Will you tell us about a security incident?+
Yes. Within 72 hours of us finding out, or sooner if your contract or the law requires it.
What if a laptop is lost?+
Our devices are encrypted and lock themselves after five minutes. A lost device is treated as a security incident: it is locked remotely, credentials are changed, and you are told if your data could be involved.
What if Tesray is not around?+
The system keeps running. It lives in your accounts, the code is in a repository you can access, and you hold a written handover of how it works.
How do we report a security issue?+
Email contact@graystecher.biz with what you found, and we will follow up with you directly.
Before you work with us.
Hawaii based, working with businesses nationwide
See what we can do for your business.
Start with a 15–30 minute discovery call where we take an initial look at your business, identify quick wins, and see if we are the right fit.