Read this before the first call. It covers where your data goes, who processes it, what we keep, and the certifications we do not hold yet. Send us your questionnaire first.
We deploy and run governed agents for clients, so this page states our own controls plainly. If your review needs something it does not cover, write to support@surehand.io. A person answers in writing, with their name on it.
We will complete your security questionnaire, sign your NDA, and sign a data processing agreement before any material changes hands. None of that requires a sales call first.
Deployments run on Gatehouse, our control plane. The records, access logging, spend limits and override rules on this page come from Gatehouse, and the rest are ours as a firm. Gatehouse has its own security page↗.
/02
The data we handle
We handle two kinds of data, and we keep them apart. Website data is the email you give us when you write, plus standard technical logs. Engagement data is the business material a deployment reads inside its written scope, and the sealed records Gatehouse writes about each run. We use engagement material only to deliver the contracted service.
/03
Where your data goes, and who processes it
This is the data flow diagram a security review asks for. The dashed line marks what Gatehouse checks and records under the signed manifest. Nothing crosses that line unless the manifest names it.
Material reaches a model provider only inside the manifest's scope, under API terms that exclude training. Each crossing is logged.
This table lists every processor we use today. For an engagement, the exact set is fixed in the signed manifest, and nothing is added to it without notice in writing.
Sub-processors: each provider, its role, the data it touches and its location
Provider
Role
Data touched
Location
Vercel
Hosting for this website, and cookieless page-view counts
Website traffic, form submissions in transit
United States
Model providers
Inference for deployed agents, under API terms that exclude training. Each is named in the signed manifest.
Only material inside the manifest's scope
Depends on the provider named
Discord
Lead notifications to our operations channel
The name, email and message you send from a form
United States
Resend
Transactional email, only where enabled
A copy of each lead by email
United States
Google Analytics, Microsoft Clarity
Site analytics
Not loaded today. If we add them they load only after you consent, and this row will say so.
United States
/04
Security practices
Transport
Data moves over TLS. The site redirects plain HTTP and sends a strict transport security header.
At rest
Data at rest is encrypted in the stores we control.
Access
Access is least privilege and scoped to each engagement. Only the people operating your deployment can reach your material, and each access is logged.
Records
Each sealed record is chained by SHA-256, so an edit breaks the chain in view. Your team can check that on its own side. The record on Gatehouse↗
Overrides
A hold goes to one named approver. Overriding a block takes two names, both saved with the override.
Your data and models
Material inside an engagement is processed under API terms that exclude training on it. Nothing from an engagement appears in our marketing, apart from composite cases, anonymised by agreement.
/05
Retention and deletion
Sealed records are kept for the retention period your contract sets. Where a regulator sets a floor, the contract states it. You can export the full record set at any time during the engagement. The export reads without Gatehouse installed.
At the end of an engagement you take a full export, and we delete what we hold on the schedule the contract sets. Website data is kept only as long as it is needed. Ask what we hold about you and we correct or delete it, and we keep a note that we did.
/06
What we hold and what we do not
We are a small, early firm. This list shows what we have today and what we do not.
In place today
NDA and DPA signed first
Questionnaires answered in writing, with a name on them
Encryption in transit, and at rest in the stores we control
Least-privilege access, itself logged
Sealed records, chained by SHA-256
Export in open formats that reads without Gatehouse installed
Not yet, and we will say so
SOC 2 Type II
ISO 27001
Third party penetration test report
A named security officer
No SOC 2, no ISO 27001 today. You hear it from us first when this changes.
In one signed manifest per deployment, versioned like code and agreed before anything is built. It names the systems the agent may read, the actions it may take, and the items it must never touch. You hold the document.
What can it do that we have not approved?
Anything the manifest allows, which is why the manifest is short and you read it before we build. Anything it does not allow is refused before it runs, and the refusal is written to the record. Gatehouse's default is refuse.
How do we change scope after launch?
Ask for the change in writing. It takes effect when we deploy it, and the record shows who asked and who approved.
Failure · what happens when it is wrong?
What happens when the system is not sure?
The run holds and goes to one named approver with the evidence gathered. It waits for their decision.
Can we see a held run and who it went to?
Yes. In a walkthrough we open the simulated held run, INV-40218, labelled as such. In production each hold sits in the record with its time, its evidence and the approver's name.
Continuous evaluation on Gatehouse re-checks past decisions against the current policy, so drift shows in the audit trail. Your team can read it there at any time.
Cost · what does it cost when nobody is watching?
What is the per run cost, and what makes it rise?
The proposal states the price. Long documents and retries raise what a run costs. The spend limit in the manifest caps the total.
Can it exceed a limit we set?
No. Gatehouse checks the limit before the action runs, not on a dashboard afterwards. At the limit the run holds and goes to the approver, and the work done so far is kept.
What can it commit on our behalf, in money?
Only up to the commitment limit the manifest sets for each decision type. Anything above it goes to one named approver, and the approval is saved with the run.
Evidence · what can you prove afterwards?
Can we see one complete run from a date we choose?
Yes, in any engagement. The record is complete when the run closes, so we open it and you read it.
What did a decision rest on?
The record cites the passages, rows or fields the decision relied on, and you read the source itself.
If we part company, what do we keep?
You keep the trail, the policy history and the labelled examples. They export in open formats on demand and read without Gatehouse installed.
We answer your questionnaire in writing, with a name on it, usually inside two business days.
