We run AI agents inside your systems. So our own controls are written down here, plainly. Need something this page doesn't cover? Write to support@surehand.io. A person answers in writing, with their name on it.
We complete your questionnaire, sign your NDA and sign a DPA before any material changes hands. None of it needs a sales call first.
Records, access logging, spend limits and override rules come from Gatehouse, the software every deployment runs on. The rest are ours as a firm. Gatehouse has its own security page.
/02
Two kinds of data. Kept apart.
Website data: the email you give us when you write, plus standard technical logs. Engagement data: the business material an agent reads inside its written scope, and the records Gatehouse writes about each run. Engagement material is used only to deliver the contracted service.
/03
Where your data goes. Who processes it.
The data flow diagram your review will ask for. The dashed line is what Gatehouse checks and records. Nothing crosses it unless your signed rules name it.
Material reaches a model provider only inside the manifest's scope, under API terms that exclude training. Each crossing is logged.
Every processor we use today. For your engagement, the exact set is fixed in the signed manifest. Nothing is added without notice in writing.
Sub-processors: each provider, its role, the data it touches and its location
Provider
Role
Data touched
Location
Vercel
Hosting for this website, and cookieless page-view counts
Website traffic, form submissions in transit
United States
Model providers
Inference for deployed agents, under API terms that exclude training. Each is named in the signed manifest.
Only material inside the manifest's scope
Depends on the provider named
Discord
Lead notifications to our operations channel
The name, email and message you send from a form
United States
Resend
Transactional email, only where enabled
A copy of each lead by email
United States
Google Analytics, Microsoft Clarity
Site analytics
Not loaded today. If we add them they load only after you consent, and this row will say so.
United States
/04
What we do today.
Transport
Data moves over TLS. The site redirects plain HTTP and sends a strict transport security header.
At rest
Data at rest is encrypted in the stores we control.
Access
Access is least privilege and scoped to each engagement. Only the people operating your deployment can reach your material, and each access is logged.
Records
Each record is chained by SHA-256. Edit it and the chain breaks, in view. Your team can check that on its own side. The record on Gatehouse
Overrides
A hold goes to one named approver. Overriding a block takes two names, both saved with the override.
Your data and models
Material inside an engagement is processed under API terms that exclude training on it. Nothing from an engagement appears in our marketing, apart from composite cases, anonymised by agreement.
/05
How long we keep it. How you get it back.
Sealed records are kept for the retention period your contract sets. Where a regulator sets a floor, the contract states it. You can export the full record set at any time during the engagement. The export reads without Gatehouse installed.
At the end of an engagement you take a full export, and we delete what we hold on the schedule the contract sets. Website data is kept only as long as it is needed. Ask what we hold about you and we correct or delete it, and we keep a note that we did.
/06
What we hold. What we don't, yet.
We are a small, early firm. Here is the full list, both columns.
In place today
NDA and DPA signed first
Questionnaires answered in writing, with a name on them
Encryption in transit, and at rest in the stores we control
Least-privilege access, itself logged
Sealed records, chained by SHA-256
Export in open formats that reads without Gatehouse installed
Not yet, and we will say so
SOC 2 Type II
ISO 27001
Third party penetration test report
A named security officer
No SOC 2, no ISO 27001 today. You hear it from us first when this changes.
In one signed manifest per deployment, versioned like code and agreed before anything is built. It names the systems the agent may read, the actions it may take, and the items it must never touch. You hold the document.
What can it do that we have not approved?
Only what the manifest allows. That's why it's short, and why you read it before we build. Anything else is refused before it runs, and the refusal goes on the record. Gatehouse's default is refuse.
How do we change scope after launch?
Ask for the change in writing. It takes effect when we deploy it, and the record shows who asked and who approved.
Failure · what happens when it is wrong?
What happens when the system is not sure?
The run holds and goes to one named approver with the evidence gathered. It waits for their decision.
Can we see a held run and who it went to?
Yes. In a walkthrough we open a simulated stopped run, labelled as such. In production every stop sits in the record with its time, its evidence and the approver's name.
Continuous evaluation on Gatehouse re-checks past decisions against the current policy, so drift shows in the audit trail. Your team can read it there at any time.
Cost · what does it cost when nobody is watching?
What is the per run cost, and what makes it rise?
The proposal states the price. Long documents and retries raise what a run costs. The spend limit in the manifest caps the total.
Can it exceed a limit we set?
No. Gatehouse checks the limit before the action runs, not on a dashboard afterwards. At the limit the run holds and goes to the approver, and the work done so far is kept.
What can it commit on our behalf, in money?
Only up to the commitment limit the manifest sets for each decision type. Anything above it goes to one named approver, and the approval is saved with the run.
Evidence · what can you prove afterwards?
Can we see one complete run from a date we choose?
Yes, in any engagement. The record is complete when the run closes, so we open it and you read it.
What did a decision rest on?
The record cites the passages, rows or fields the decision relied on, and you read the source itself.
If we part company, what do we keep?
You keep the trail, the policy history and the labelled examples. They export in open formats on demand and read without Gatehouse installed.
A person answers your questionnaire in writing, with their name on it. Usually inside two business days.
