meirlabsYour data stays yours
Adopting AI should not mean handing your business to a black box. Here is exactly how we keep your company's data safe when we build AI into your workflows, and what we put in writing.
How we ensure your data is safe
What actually happens to your data
When we build AI into your work, your data is used to answer the task in front of it and nothing else. It is not used to train the AI, not shared, and not kept anywhere it does not need to be. The rest of this page is how we make sure of that.
Data minimization
Sensitive data stays out of any step that doesn't require it.
Row-level isolation
Row-level security stops one account from reading another's rows.
No-training tiers
Runs on business and API tiers that never train on your inputs.
Least-privilege access
Each workflow reaches only the data its job actually needs.
Secrets stay server-side
Keys and tokens stay on the server, never in the browser.
A human checkpoint
A named person signs off on anything high-stakes before it ships.
Our process
We audit before anything ships
Before a workflow touches real data, we run it through a structured security audit: the same one we publish as an open skill.
meirlabs security-audit --target production
- Nine independent lenses, from secrets and access control to injection, SSRF, and misconfiguration, each run on its own.
- Every finding is adversarially verified. Two to three independent reviewers try to disprove it, which strips a third to half of a raw scan's noise.
- All checks are read-only against production. We confirm whether a door is open. We never walk through it or change your data.
Audit complete. Nothing reaches your data unverified.
FAQ
Common questions
Does the AI learn our secrets?
No, not on the tiers we use. A model processing your request does not keep the data afterward, and business and API tiers do not train on your inputs. The fear describes training, which we never let your data touch.
Where does our data actually go?
Through a no-training business or API tier to answer the request, then nowhere. When we store data, it sits in Postgres with row-level security, and secrets never reach the browser.
Will you sign an NDA?
Yes. We sign a mutual NDA before touching anything sensitive, and a data-processing agreement wherever personal data is involved.
What about GDPR, SOC 2, or HIPAA?
Compliance is about how data is handled and how well your vendor is positioned, not whether AI is allowed at all. We build on compliant tiers and help you sign the data-processing agreement that keeps regulated data on the right footing.
Can the AI act on its own, like sending an email or deleting a record?
Not without a human sign-off. Workflows start read-only, and anything that writes, sends, or deletes goes through a named person who approves it before it fires. Nothing customer-facing runs on autopilot.
What if the AI gets tricked into leaking data?
Prompt injection is a real threat, and it is one of the nine lenses in our pre-launch security audit. We also limit what each workflow can see and do, so even a tricked model can only reach the data its job needed in the first place.
Can we declare some data completely off-limits?
Yes. We agree on off-limits data at the planning stage, and data minimization enforces it: excluded data never enters the workflow, so there is nothing for the AI to leak.
Isn't this riskier than what our employees already do with free ChatGPT?
Usually the opposite. Employees pasting data into free consumer chatbots is the real exposure, because consumer tiers can train on inputs. A managed setup moves that same work onto no-training business and API tiers, with access controls around it.
Get started
Start where the stakes are low
The safest way to prove this out is a low-stakes workflow first, not a customer-facing system on day one. Book a free AI plan and we will find one together.