Clarify data flows first
What data is needed? Which providers process it? Where is it stored? These questions are documented per project. We do not make a blanket promise that every solution runs exclusively in Switzerland.
Limit access
People and automated processes should receive only the permissions needed for their tasks. Existing access rights must be respected in search, integrations and AI-generated answers.
Plan for oversight
Uncertain outputs, exceptions and critical actions need a clear review path. Logs should support traceability without collecting unnecessary sensitive information.
Choose providers deliberately
Model terms, retention and possible use of inputs are reviewed before deployment. Specific providers and contractual arrangements are determined per project.
Agree on responsibilities
Confidentiality, personal data processing, retention and deletion must fit the actual engagement. Required arrangements are agreed before processing begins.