Security and data handling

This page describes the standard security and data handling practices of NAK Media ("we", "us") when we design, build, host or support software, AI and automation systems for clients. It is provided for information. The binding security obligations for any engagement are those set out in the signed Project Agreement and, where personal data is processed, the data processing agreement between us and the client.

How we handle personal data collected through our own website is described in our Privacy Policy.

We set up hosting, databases and storage in your own cloud accounts, so you choose the region and keep control.

If you have no preference, Indian clients are hosted in an India region and other clients in the nearest region to their customers. For UAE clients that is a UAE or Middle East region where the provider offers one.

NAK Media's own records (enquiries and project notes) are kept in Supabase and Notion, as described in our privacy policy.

Language models: enterprise APIs from OpenAI and Anthropic. Calls and messages: Twilio and the WhatsApp Business API. Where data must not leave your network, we deploy open-weight models inside your own cloud or private servers.

The exact providers for your project, and what each one receives, are listed in your proposal before any work starts.

Your data does not train public models. We use business endpoints where training on your data is off, or self-hosted models where required.

Where a provider offers zero or minimal data retention, we turn it on. We only store full conversation transcripts when you ask us to, for quality review.

Systems we build give each person access only to what their role needs, with a record of who changed what.

Only the named people on your project get access to your systems. Every account uses multi-factor authentication, and we remove our access when the project or support plan ends.

Keys and passwords are kept in a password manager or the cloud provider's secret store, never in code or chat. We rotate them at handover.

Every AI agent knows what it cannot handle and passes the conversation to a person, with the full context attached. Callers are told they are speaking with an AI assistant.

Every automated workflow has retries, an alert to your team and a documented manual fallback.

New AI systems start as a pilot on a share of traffic, are tuned on real transcripts, and roll out fully only with monitoring and a manual fallback in place. After launch we review accuracy every month.

For clinics we build patient records with consent controls and keep each clinic's data separate. Data is encrypted in transit and at rest.

We follow the DPDP Act for patients in India and sign a data processing agreement with every healthcare client. For UAE clinics we work with your compliance team on the local health data rules that apply to you. We do not hold a healthcare-specific certification.

If we find a security incident affecting your data, we tell you within 72 hours and help you meet any reporting duty you have.

Where the client is the Data Fiduciary under India's Digital Personal Data Protection Act, 2023, we provide the information it needs to notify affected individuals and the Data Protection Board of India within the time limits set by law.

To report a security vulnerability in our website or a system we operate, email [email protected] with a description and the steps to reproduce it. We acknowledge reports within 3 business days and keep you informed until the issue is resolved.

While testing, you must not access, modify or delete data belonging to others, degrade the service, or use social engineering or physical attacks. Reports made in good faith and in line with these rules will not be pursued legally by us.

Security is shared. Where systems run in a client's own cloud accounts, the client remains responsible for its account ownership, billing, user management after handover and the security settings it changes. Third-party platforms such as cloud and AI providers are governed by their own terms and security commitments.

No system can be made completely secure. We apply reasonable security safeguards appropriate to the nature of the data and the risk, but we do not guarantee that any system will be free from all vulnerabilities or attacks.