Trust & Responsible AI Center
How we keep AI systems accountable
Security, data handling, human oversight, privacy and deployment, described as the practices we design into client systems. Where a practice depends on your environment, we say so.
Scope of this page. These are our delivery standards for systems we build. They are not third-party certifications, and SASARAN Technology does not currently claim any security or AI management certification. Certifications will be listed here only with evidence.
/ 01Core practices
Eight commitments
01
Human oversight by design
Consequential actions such as sending, writing to systems of record or spending require a named person to approve, with the evidence in front of them.
02
Evaluation before release
Every AI system ships with a test set agreed with domain experts. Changes to prompts, models or retrieval are scored before they reach users.
03
Least privilege
AI components receive only the data and tool permissions a task needs. Secrets stay server-side and are never placed in prompts.
04
Your data stays yours
We use model providers under terms that exclude training on your data, or host models in your environment. No client data is used to train shared models.
05
Traceable outputs
Answers cite their sources. Runs are logged with redaction and retention you control, so any output can be investigated.
06
Deployment where you need it
Commercial APIs, regional cloud services or private hosting, chosen per workload against your data protection obligations.
07
Prompt-injection defences
Untrusted content is kept apart from instructions, tool calls are validated against schemas and risky actions need confirmation.
08
Incident response
Each production system has an incident runbook covering detection, containment, communication and post-incident review.
/ 02In detail
Topic by topic
Data flow
Before build, we document every data flow: which sources the system reads, what is sent to which model or service, what is stored, where and for how long.
Data flow diagrams are a deliverable you keep and update. They are the basis for privacy and security reviews.
Consent and lawful basis
Where AI processes personal data, your organisation remains the controller and decides the lawful basis. We design systems to support your data protection obligations, including transparency to the people affected.
Systems that talk to people disclose that they are AI.
Access controls
AI systems inherit your identity provider and source-system permissions. Retrieval filters content by the requesting user before anything reaches a model.
Administrative access to prompts, logs and evaluation data is limited to named roles.
Human review
We classify actions by consequence and reversibility. Drafts are reviewed before sending; system changes are proposed and confirmed; high-impact actions can require dual approval.
We monitor approval patterns for signs that review has become a formality.
Evaluation
Evaluation sets are built from real inputs with expected results agreed by your experts, and include adversarial and out-of-scope cases.
Results are reported per release, and production failures become new test cases.
Redaction
Personal and sensitive fields can be masked before content reaches a model where the task allows, and before anything is written to logs.
Logging and retention
We log model calls, tool calls and outputs to make systems debuggable and auditable. Retention periods are agreed with you and enforced automatically.
Deployment choices
We compare hosted APIs, cloud model services in your account and self-hosted open-weight models on quality, cost, latency and data requirements, per workload.
Incident response
Each system has a runbook: how incidents are detected, who is notified, how to disable or roll back AI features and how lessons are captured.
/ 03Reference frameworks
What we align with
We use public frameworks as reference points when designing governance and controls, including the NIST AI Risk Management Framework, the OWASP Top 10 for LLM Applications and ISO/IEC 42001.
Alignment means we use them to structure our work. It is not a claim of certification or audit.
/ 04Security contact
Reporting a concern
If you believe you have found a security or privacy issue with this website or a system we operate, please use the contact form and mark it as a security concern. A dedicated security contact will be published here once confirmed.
Need answers for a security review?
We can walk your security and privacy team through how a proposed system would handle data, access and incidents.