Security & Privacy
Trust starts with saying what is—and isn’t—ready.
Readiness status
Verified
Sample-only preview behavior
The inspected preview uses synthetic records and local, simulated task actions. Its task plans do not call an AI model, connect business apps, send follow-ups or update external records. Preview task state resets when the page is reloaded. This verifies the demonstration only—not a production deployment or a security audit.
In development
Intended production safeguards
This category describes planned production work, not protections verified as implemented. Least-privilege access, client isolation, masking, secure credential handling, human approval and retention controls need implementation and testing before handling real information.
Not yet verified
Production systems and vendor terms
The production AI model/provider, training and retention terms, complete data flows, hosting protections, encryption, access controls and incident readiness have not been verified. No compliance, certification, no-training or zero-retention claim is made.
A universal baseline before real data
The following are requirements for production readiness. Their implementation and effectiveness are not yet verified.
Access and isolation
Least-privilege permissions must limit each user and automation session to authorized tools and records. Tenant and client isolation must prevent one business or client from accessing another’s information, including through AI context, search and exports.
Sensitive information before AI
Map the flow of personal, customer, employee, health and financial information. Minimize collection and mask or redact sensitive fields before any AI request; test for leakage through prompts, files, tool responses and attachments.
Transport, storage and credentials
Verify encrypted transport and storage, key management and access restrictions. Credentials belong in a restricted vault, not prompts, browser logs or screenshots. Credential vaulting and encryption are not verified here.
Retention and records
Define limited retention, deletion procedures and recovery rules. Redact logs and screenshots, restrict who can read them, and verify protections for activity-history integrity. The preview activity history is not an immutable production audit log.
Approval and accountability
Enforce human review of exact recipients and content before external messages, submissions, payments or sensitive record changes. Record the decision and scope; prevent bypasses, repeated actions and changes after approval.
AI vendors and data use
Review each model/vendor’s training use, retention, subprocessors, processing locations and contract terms. Verify the actual configured service and end-to-end data flows. We cannot yet say your data is excluded from training or retained for zero time.
Incident response
Establish named response owners, monitoring, access revocation, recovery and notification procedures. Test the response process before production use; operational readiness has not been verified.
Overseas staff and transfers
Review where staff, vendors and subprocessors access or process sensitive information. Assess cross-border transfers, access restrictions, disclosures and consent requirements before enabling overseas access.
Additional requirements depend on the industry
The same operator may encounter very different information. Each use needs its own legal, security and vendor review. These are requirements subject to implementation and verification—not certifications or statements of compliance.
Accounting & tax
Evaluate use or disclosure of tax return information under IRC Section 7216, including taxpayer consent and overseas disclosure requirements. Assess the FTC Safeguards Rule where applicable and use IRS Publication 4557 to inform security planning. The preview is not approved for live taxpayer information.
Healthcare administration
Determine whether a workflow involves protected health information (PHI), and whether HIPAA applies. Where applicable, review business associate agreements, permitted uses, access, safeguards, audit records and breach procedures. Administrative work is not automatically outside HIPAA. No HIPAA compliance claim is made.
Financial records
Review applicable financial privacy, security and recordkeeping obligations. Limit account and payment information, verify vendor terms and require authorization for financial actions. No financial-services certification or production protection is claimed.
Consumer & employee data
Assess applicable privacy and employment-data requirements, permitted purposes, notices, access restrictions, deletion and retention. Minimize personal information across retail, property, logistics and general office workflows. Review data transfers and third-party access before use.
This is a readiness disclosure, not legal advice or a compliance statement. Qualified professionals should review the actual workflow, data flows and protections before production use. An illustrative example does not establish that VOSS is suitable for regulated data.