Security and data handling

How we handle your systems and data on every project.

Access: Read-only keys. We do not ask for write access, admin keys or production credentials.
Where the work runs: In your cloud account, or in a sandbox set up for your project alone.
Retention: Client data is deleted within 7 days of delivery, and we confirm the deletion in writing.
Data location: Your cloud account, or a project-only sandbox in the EU or the US. Nothing in personal cloud drives.
Work devices: Full-disk encryption on every work device, and MFA on every account that touches client data.
Breach notice: If an incident affects your data, we tell you within 72 hours of discovering it.
Personal data: PII is redacted before any analysis. We work on redacted exports, not raw records.
Contracts: NDA and DPA (with EU Standard Contractual Clauses) on request, and a one-page fixed-scope SOW for every project. The NDA is signed before any data is shared.
Payment: PayPal Business invoice (card or PayPal), due within 14 days of the acceptance test passing.
Ownership: You own all code, tests and reports we deliver.
Subprocessors and model providers: Two categories at most: a model API provider (by default, the one you already use) and a cloud host for the sandbox. Each is named in the scope and used only with your approval.
Who does the work: KH Labs is founder-led; Khoa does the engineering. Calls on request, at a time that suits both time zones.
Security contact: Email khoatran.mma26@gmail.com or message Khoa Tran on LinkedIn. We reply within 24 hours.
What we are not: We are not a CPA firm. We give no SOC 2 opinion and no certification. Our reports are independent adversarial test reports; your auditor decides how to use them.