Your data stays yours.
Who we are, how contracts work, and how we handle your data.
Clear about your data, ownership and security
- NDA on request
- You own the work
- Role-based access
- One-time codes
- Audit logs
- Each client's data kept separate
Control and audit by design
- Access controlRole-based access, and one-time codes for sensitive changes.
- Audit logsEvery action is recorded; records can't be changed later.
- Ownership & NDAYou own what we build, in writing. NDA on request.
How we handle your data
Eight things you should know before a pilot.
We confirm each point in writing before a pilot, and walk through your security needs with you.
What data we access
Only the data the agreed problem needs, listed in your written agreement. Depending on the system, that can include customer and contact details, tickets and messages, employee and attendance records, invoices, payments and expenses, and documents you upload.
Where it is stored and processed
On secure cloud servers. The exact provider and region for your project are confirmed in writing before the pilot starts.
Which AI services receive it
Depending on the system: Anthropic (Claude), OpenAI, Google (Gemini), Groq and Cerebras for text and images, Hugging Face for search, and Tavily for web research. We send only what each task needs, and we tell you in writing which services your system uses.
Whether it is retained or used for training
For client projects we use AI services on business terms, and we confirm in writing which providers are used and that your data is not used to train their models before any client data is shared.
Who can access it
Only the people you approve in your company, through role-based access, and the named Arjava team members who build and support your system. Each client's data is kept separate from other clients' data, sensitive changes need a one-time code, and actions are recorded in an audit log.
How long it is kept
Under our standard terms, we keep your data while your agreement is active. After it ends, we keep it only as point 7 describes, unless the law requires us to keep it longer, as set out in your written agreement.
How it is deleted or returned
Under our standard terms, at the end of the engagement we return your data on request in a standard format (such as CSV or Excel), then delete it from our systems within 30 days and from backups when they expire, as set out in your written agreement.
What happens in a security incident
Under our standard terms, we notify you without undue delay, and within 72 hours of confirming an incident that affects your data, in line with applicable US state breach notification laws. We tell you what happened, what data was affected and what we're doing about it, as set out in your written agreement.
US working hours
Team in India, working 8 a.m. to 12 p.m. Eastern Time (ET).
US contracts
A written agreement before work starts. Billed in US dollars.
Security roadmap
Need a certification such as SOC 2? We agree a plan and timeline in writing.