Security, privacy and AI

We ask only for the data the project needs and work with test or anonymised data whenever the real thing is not necessary.

Data travels encrypted (TLS) and is stored encrypted wherever the platform supports it, which the cloud providers we use do.

Passwords, API keys and other secrets live in the provider's secret manager, never in the code or in chats.

When the project ends we return or delete your data, as you prefer, and remove our access.

In your cloud account, or in ours if you prefer us to run it. Before we start we write down which providers and regions each part uses.

For clients in the EU we use European regions whenever the service offers them. When a provider processes data outside the EU (for example, some AI models), we tell you beforehand and rely on the safeguards the GDPR requires, such as the European Commission's standard contractual clauses.

We sign a data processing agreement (article 28 GDPR) before we touch any personal data, and an NDA before the first call if you need one.

You own 100% of the code and intellectual property we write for you.

We are happy to fill in your security questionnaire or your supplier assessment.

The AI Act (Regulation (EU) 2024/1689) sorts AI systems by risk and its obligations apply in phases. This is how we work with it on every project:

We classify each system when we design it, and write down why. We do not build systems for practices the Act prohibits.

When people talk to an AI, they are told so, as our own assistant on this site does. Content generated by AI is labelled where the Act requires it.

If a use could be high risk (hiring, credit, access to essential services, among others), we tell you before we start: it needs risk management, documentation, logging and human oversight, and that takes time and budget we plan for from day one.

We test quality with real examples before launch and after every change, keep logs of what the system decides, and keep a person in the loop where decisions affect people.

We are engineers, not lawyers: for high-risk cases we work alongside your legal advisers.

We mostly build with Claude, by Anthropic, and use other models when a project needs them. When data cannot leave your infrastructure, we can run open models on your own servers.

We use these services under business or API terms that do not use your data to train models by default, and we confirm each provider's terms with you before we start.

Separate environments for development, testing and production. Changes reach production only through review and automated checks.

We keep dependencies up to date and check them for known vulnerabilities.

For the systems we run for you, we set up monitoring, backups and a written recovery plan, and we test the restore.

We tell you as soon as we know, and in any case within 24 hours, with what happened, what it affects and what we are doing about it.

If personal data is involved, we help you notify the Spanish Data Protection Agency (or your authority) within the 72 hours the GDPR sets.

We do not use cookies that need your consent, and the visit count stores nothing in your browser. The AI assistant says it is AI, and we do not store the conversations.

The details are in the privacy and cookie policies, linked at the bottom of every page.

Write to hello@zeroone.es and a senior engineer will answer, not a sales team.