Security and data, in plain sight.

For client builds, we deploy into your own cloud account wherever possible, so your data, code, and infrastructure stay under your control. Where a system runs on infrastructure we operate, such as Harnad Voice and Harnad Connect, each customer’s data is kept in an isolated tenant.

• Access is limited to the engineers working on your system, using role-based access and individual accounts
• Secrets and API keys are stored in a secrets manager, never in code
• Access and key actions are logged, and access is removed when an engagement ends
• We are happy to work under an NDA and within your own access policies

Depending on the system, data may be processed by these providers on our or your behalf:

• Google Cloud: hosting, databases, storage, and AI models (Vertex AI)
• Twilio: phone numbers and call handling for voice systems
• ElevenLabs: speech generation for voice agents
• Meta: the WhatsApp Business Platform, as an independent provider
• Cal.com: scheduling when you book a call with us
• Other model providers only where you choose them, for example with your own key (BYOK)

We list the providers for each system in its written scope before it goes live.

We do not use your data, or your customers’ data, to train models of our own. We use model providers’ business and API services, configured so that your inputs are not used to train their models where the provider offers that option. Processing may take place outside India where a provider operates; we tell you where before a system goes live.

Voice systems can record and transcribe calls. Where they do, the caller hears a consent message at the start of the call, and recordings and transcripts are kept only for the period agreed with the client, then deleted. Clients can request deletion of specific recordings at any time.

Data is kept for the period agreed in each engagement and deleted or returned at the end of it. For our products, customers control retention for their account and can request deletion of their data.

For healthcare and other regulated work we build in consent capture, restricted access, isolated tenancy, and audit logs, and we keep data in your own cloud where required. We describe the specific controls for each project in writing. We do not claim certifications we have not been assessed for.

If you believe you have found a security issue in our website, products, or a system we operate, email hello@harnad.com with the subject “Security report”. Please do not access data that is not yours. See also our privacy policy.