The answers to your security questionnaire, before you send it.

Never. No client content trains or fine-tunes any model, ours or a provider's, and none of it enters a shared evaluation set. Where a model provider sits in the path, the account is configured so your content is not retained for training. This is the first question almost every regulated buyer asks, and the answer has no conditions attached to it.

Yes. PostgreSQL with pgvector, the embedding pipeline and the API can all run in your own cloud account or data center, so your corpus is stored and searched only in your infrastructure, and MetaMinds works through access you grant and can withdraw. The limit is worth stating precisely rather than glossing: the passages retrieved for each question still go to the model, so where the model runs is what decides whether they leave your tenancy. That is settled in the engagement's architecture document.

The smallest sample that answers the question, not your full corpus. Where a staging copy with realistic structure is enough to reproduce the behavior under test, production data is never touched at all. What is in scope is written down before anything moves, rather than negotiated once an engineer already has a copy.

In the region you specify, fixed in the contract before anything moves. For a self-hosted deployment the corpus stays in your infrastructure. Where the model runs is set in that engagement's architecture document rather than assumed, because it is the decision that determines whether retrieved passages cross a border.

Yes, or provide ours as a starting draft. MetaMinds publishes its own addendum in full on this site rather than sending it on request, so your counsel can read the processor terms, the security measures, the subprocessor position, the breach notification commitment and the deletion terms before a call is booked. Standard Contractual Clauses where an EU transfer is in scope, and a named point of contact for data-subject requests.

Published, not supplied on request. The list on this site names every third party, what it actually receives rather than a category, its processing region, whether it is active today, and the integrations that are present in the code but switched off. During an engagement you are told before any change to that list takes effect, rather than after it.

In transit, HTTPS only. At rest, this website holds no client data whatsoever: no client database, no object storage, and enquiries arrive as email. The only database this site runs is its self-hosted page-view counter, which stores no IP address and sets no cookie. For an engagement, encryption at rest is a property of the deployment and is stated in that engagement's architecture document, and where we build inside your tenancy the keys are yours.

For the engagement, and then it is deleted. Working copies are destroyed on a date written into the scope, at completion or earlier if you ask, and the destruction is confirmed to you in writing. No corpus is kept afterward. Deletion is a line item in the contract rather than a favor you have to chase.

Named engineers on your engagement, on least-privilege credentials, with no shared accounts. You can revoke any credential without calling us first. The scope requested is the narrowest one that completes the work, which is also the arrangement that makes the revocation meaningful.

No. Findings are not published, reused as case material, or attributed to you without written permission. That policy is the reason this site names no clients and shows no logos, which costs a commercial firm something real and is the trade MetaMinds has made.

$6,500 for 2 weeks of testing, with $1,200 as the deposit that reserves a named start week. It is a fixed scope at a published price rather than a day rate, and the price is the same figure whoever is asking. Every price on this site is checked against our claims register by the build itself, so the number here and the number in a proposal cannot disagree.

Five areas, tested on the system as deployed rather than as documented. Prompt injection, including through your own documents: injection arriving through your own retrieved documents, tool output and uploaded files, not just through the input box. Data exfiltration and tenancy boundaries: whether the system can be steered into returning another tenant's documents, another matter's files, the system prompt, or secrets leaking through tool output, errors and logs. Agent authority and blast radius: what the agent can touch when it is steered (tools, credentials, writes, spend), and whether the kill switch, audit trail, limits and human sign-offs exist in the code rather than only on the architecture diagram. Application penetration testing around the model: authentication, sessions, tenancy checks, the API and the ingestion pipeline, tested like any web application. Grounding, measured on your data: how often an answer is supported by the source it cites, scored against a set built from your own corpus rather than a public benchmark.

Aniruddh Atrey, Founder and CTO of MetaMinds, who holds the EC-Council Certified Ethical Hacker credential and is ISO/IEC 27001 trained. That second line is personal training rather than an organizational certification, and it is never described here as more than that. The offensive background behind the practice is penetration testing across 50-plus government web assets, delivered under public sector engagement rules, on a program that reduced critical CVE exposure by 65%. Read both figures narrowly: they are past tense, they belong to that program, and they are not a result promised to you, because nobody can promise a percentage before seeing the estate. On your engagement, the only people holding credentials to your systems are the named engineers on it, on least-privilege access, with no shared accounts.

Yes, and that is the usual case. The assessment is an independent test of an AI system you run or bought. The report is written twice over, with reproduction steps and severity for your engineers and consequence and decision for your board, and it carries an explicit section naming the findings you do not need us to fix. A remediation plan is ordered by exposure rather than by how interesting the bug is.

The findings report, the remediation plan, and the grounding evaluation harness built on your own data, which stays with you. The harness is the part that matters after the engagement closes: it is what lets you re-run the measurement against a new model version or a changed corpus without hiring anyone back to tell you whether the number moved.

In scope: prompt injection and indirect injection, data exfiltration paths, tool and function-call authority, what an agent may do without a human, and what leaves the boundary in a prompt. Handled separately: the certification audit itself, which an accredited certification body runs on its own engagement, and remediation, which is scoped as its own piece of work once the findings name what needs changing. The report is written so your engineers can act on it and your auditor can read it.

No, and the reason is the same discipline as the SOC 2 answer. The CAIQ is the Cloud Security Alliance's own instrument, and a document presenting itself as a completed CAIQ implies a formal self-assessment that nobody has performed. What is published instead is an answer for each of the 17 domains of the CSA Cloud Controls Matrix v4, in our own words, with a column saying where a reviewer can check it without asking us: 9 substantive, 1 stating something is not held, 1 not applicable to how this firm operates, and 6 saying plainly that nothing is published yet. A reviewer can map those onto their own questionnaire, which is what they actually need.

By the same gates the engineering work is held to, and this page publishes what each gate requires rather than a result nobody has measured. Eight conditions, each stated as the thing its gate fails on and each with the command behind it on the page: horizontal overflow, every route at 24 device sizes; overflow hidden by a clipping ancestor, which a page-width sweep cannot see; pages that render with JavaScript disabled, the h1 painted and no block of content hidden; pages with nothing left animating under prefers-reduced-motion; keyboard paths, phone and desktop: none of the first 30 Tab stops is a zero-size element, and no content is revealed only on hover; exactly one h1 per page, and no skipped heading levels; internal links that lead to a page that does not exist; published USD prices with no row in the claims register. This version of the site has not been run against them yet, and the board says so instead of drawing a pass tick.

You are told, and the commitment itself is the one written into the data processing addendum published in full on this site, not a paraphrase of it here. That is deliberate rather than evasive: a notification window restated on a marketing page is a second copy of a contractual term, and the second copy is the one that quietly stops matching the first. Read it in the addendum, where your counsel can hold MetaMinds to it. What belongs here instead is why the exposure is small before anything goes wrong. The people holding credentials to your systems are named engineers on least-privilege access that you can revoke without calling us. The data MetaMinds asks for is the smallest sample that answers the question rather than your corpus. Working copies are destroyed on a date written into the scope. An incident reaches less of your estate because less of your estate was ever in reach.

Through the security mailbox published in the security.txt file at the standard well-known path on this domain, which also names the contact form as a second channel, carries a canonical URL for itself, sets an expiry date in the future so it reads as current rather than stale, and states in plain words that a good-faith reporter will not be threatened for reporting. A firm that sells penetration testing and is itself unreachable by the people who find things is making an argument against its own practice, so the file exists, and its policy link points at this page.