1. Overview
This Data Processing Policy describes how Achiral AI processes, stores, and protects customer data in our AI assistant platform. Our platform provides organizations with dedicated AI assistants (Chiro) powered by large language models and vector databases. This policy complements our Privacy Policy and Terms of Service.
2. Data Categories
2.1 Customer Account Data
- Account credentials and authentication information
- Profile information (name, email, company details)
- Subscription and billing information
- User preferences and settings
2.2 Organization Data
- Organization profile and configuration
- Team member information and access controls
- Project and workspace metadata
- Usage metrics and analytics
- Custom integrations and API usage
2.3 AI Processing Data
- Conversation history with AI assistants
- Documents and content uploaded for AI processing
- Vector embeddings and semantic search data
- Fine-tuning data and custom model adaptations
- AI-generated responses and recommendations
3. Data Processing Principles
- Lawfulness: All processing is based on legitimate legal grounds
- Purpose Limitation: Data is processed only for specified, explicit purposes
- Data Minimization: We collect only data necessary for our services
- Accuracy: We maintain accurate and up-to-date information
- Storage Limitation: Data is retained only as long as necessary
- Security: Appropriate technical and organizational measures protect data
- Accountability: We demonstrate compliance with data protection principles
4. Data Security Measures
4.1 Technical Safeguards
- Encryption: AES-256 encryption at rest, TLS 1.3 in transit
- Access Controls: Role-based access with multi-factor authentication
- Network Security: Firewalls, VPNs, and network segmentation
- Monitoring: 24/7 security monitoring and intrusion detection
- Backup Systems: Encrypted, geographically distributed backups
4.2 Organizational Safeguards
- Staff Training: Regular security awareness training
- Background Checks: Screening for personnel with data access
- Confidentiality Agreements: Legal obligations for all staff
- Incident Response: Documented procedures for security incidents
- Regular Audits: Internal and external security assessments
5. Data Processing Activities
5.1 AI Model Training and Fine-Tuning
Each organization receives a dedicated AI assistant with optional custom fine-tuning:
- Base models run on shared, self-hosted infrastructure
- Fine-tuned adapters are organization-specific and isolated
- Training data remains within your organization's tenant
- Vector embeddings are stored in isolated Weaviate tenants
- No cross-tenant data sharing without explicit consent
5.2 Multi-Tenant Isolation
Our platform implements strict tenant isolation:
- Logical isolation by default with dedicated Weaviate tenants
- Pod isolation for high-tier customers ($10k+/month, Elite tier)
- Automatic isolation triggers for compliance requirements (HIPAA, SOC2)
- Rate limiting and quota management per tenant tier
- Separate vector databases prevent data leakage
Customers have full control over their AI assistant's behavior, fine-tuning, and data retention policies.
6. Data Transfers and Storage
6.1 Data Locations
Customer data is stored on self-hosted infrastructure:
- Primary: On-premises Kubernetes cluster (2-node production)
- GPU compute: GX10 GPU node (dave) for AI inference
- Worker nodes: llm-wrk-1 through llm-wrk-4 for processing
- Database: MongoDB and Weaviate on dedicated storage
- Access: Via Cloudflare Tunnel (no exposed ports)
6.2 International Transfers
When data is transferred internationally, we ensure adequate protection through:
- Standard Contractual Clauses (SCCs)
- Adequacy decisions by relevant authorities
- Other appropriate safeguards as required by law
7. Third-Party Processors
We work with carefully selected third-party processors who meet our security standards:
- Infrastructure: Self-hosted Kubernetes on dedicated hardware
- GPU Compute: On-premises GPU compute for AI inference
- Vector Database: Weaviate (self-hosted)
- Payment Processing: Stripe (PCI DSS compliant)
- Media Storage: Cloudinary for image optimization
All processors are bound by data processing agreements that ensure the same level of protection as this policy.
8. Data Subject Rights
Individuals have the following rights regarding their personal data:
- Right of Access: Obtain confirmation and copies of personal data
- Right to Rectification: Correct inaccurate or incomplete data
- Right to Erasure: Request deletion of personal data
- Right to Restrict Processing: Limit how data is processed
- Right to Data Portability: Receive data in a structured format
- Right to Object: Object to certain types of processing
To exercise these rights, contact us at [email protected] with your request and proof of identity.
9. Data Breach Procedures
In the event of a data breach, we will:
- Contain and assess the breach within 1 hour of detection
- Notify relevant authorities within 72 hours (where required)
- Inform affected customers without undue delay
- Provide regular updates on investigation and remediation
- Implement measures to prevent similar incidents
10. Compliance and Certifications
Achiral AI maintains compliance with:
- GDPR: General Data Protection Regulation (EU)
- CCPA: California Consumer Privacy Act (US)
- SOC 2 Type II: Security and availability controls
- ISO 27001: Information security management (in progress)
11. Contact Information
For questions about data processing or to exercise your rights:
