Security and data handling

What happens to your fund's data when we build for you. Each commitment below is a numbered term in our client agreement, and your counsel will see the same wording.

Commitment	What it means in practice	Agreement
Runs in your environment	We build, run and store everything in your cloud account or on-prem. We copy data to our own systems only when you approve a specific task in writing, and delete that copy when the task is done.	§4.6
Model providers you approve	Data goes only to model providers you have approved, under terms that forbid training on it, with zero retention where the provider offers it. On request we use your own provider accounts, or models hosted entirely in your environment.	§4.7
No training	Your data, and anything derived from it, is never used to train, tune or evaluate any model, ours or a third party's. The only exception is a model you ask us to tune that runs solely for you inside your environment.	§4.3
No sharing, no resale	Nothing from your fund is disclosed to or used for any other client. Your data is kept separate and never sold or licensed, including in aggregated or anonymized form.	§4.4–4.5
Only the people who need it	Access is limited to the engineers on your engagement, under written confidentiality terms and trained on handling material non-public information. Access is removed when it's no longer needed.	§4.9
No subprocessors without consent	No third party processes your data unless you agree in writing, on terms at least as strict as ours.	§4.8
You hear first	If there's a security incident, or a subpoena or regulator asks for your data, we tell you promptly and within a deadline set in the agreement.	§4.11–4.12
You own what we build	Code, prompts, test sets and outputs are assigned to you, with a permanent license to any reusable parts of ours inside them.	§7
Returned, deleted, certified	At the end of the engagement, or whenever you ask, your data is returned and every copy we hold is deleted. We certify the deletion in writing. A sample is below.	§4.13

We answer your security and due-diligence questionnaire before a pilot starts, and provide evidence of these controls once a year on request (§4.14).

A sample deletion certificate

This is the document you receive when an engagement ends. It lists every place your data was held, how it was removed, and who checked.

Your compliance team can file it with the rest of your vendor records. If the law requires us to keep anything, the certificate says what and why, and that copy stays under the same terms.

Certificate of return and deletion

Ref. DS-CERT-0000 · Placeholder details

Client: [Fund name] (the “Client”)
Agreement: Master Services Agreement dated [date], SOW no. [n]
Engagement ended: [date]

Deskside LLC certifies that, under Section 4.13 of the Agreement:

Client Data was returned to the Client on [date] as [format], delivered to [location].
All copies of Client Data in Deskside's possession or control have been securely deleted, as listed below.
All Deskside access to the Client Environment was removed on [date].
No Client Data, or output derived from it, was used to train, tune or evaluate any model, other than models run solely for the Client in its environment at its written request: [none / list].
Copies kept because the law requires it: [none / describe]. Any such copy remains subject to the Agreement.

Where it was	What	How removed	Date
Client cloud: Deskside project	Pipelines, indexes, caches	Returned, then project deleted	[date]
Approved working copy (§4.6)	[description]	Crypto-erased	[date]
Engineer laptops	Local caches	Wiped and checked	[date]
Model provider	None retained (zero retention)	Provider confirmation attached	[date]
Access accounts	[n] accounts	Revoked	[date]

Send us your security questionnaire.

We'll answer it, and walk your CISO and compliance team through the deployment, before any data is shared.

Book a call →