Trust
Safe enough to leave running
An agent that touches customers, money or private data has to earn trust the same way a new employee does: limited access, close supervision and a record of everything it does. Here is how we set that up.
Security or compliance team reviewing us? Send your questionnaire and we'll complete it.
Your data
- Never used to train public models. We use model providers' business terms, which exclude training on your inputs.
- Encrypted in transit and at rest
- Stored in the region you choose, or entirely inside your own cloud account
- Personal data masked or removed before it reaches a model, where the process allows
- Retention periods agreed with you, then deleted on schedule
Access
- Each agent gets its own credentials, scoped to the minimum it needs
- Read-only by default. Write access is granted per action, not per system.
- Our engineers use named accounts with multi-factor sign-in
- Accounts and keys sit in your name, so you can revoke any of them at any time
Human control
- You decide which actions need approval: refunds, discounts, payments, deletions
- Thresholds you can tighten or relax yourself, without a developer
- Customers can reach a person whenever they ask
- A kill switch that pauses any agent instantly and routes work back to your team
Testing and monitoring
- Scored against a test set of your real cases before launch and after every change
- Tested against attempts to trick it, such as prompt injection and requests for other customers' data
- Every conversation and action logged, searchable and exportable
- Alerts when accuracy, escalation rates or costs drift outside agreed limits
Compliance
- We design to Sri Lanka's Personal Data Protection Act, No. 9 of 2022, and to the GDPR for clients with EU and UK customers
- We sign a data processing agreement before touching personal data
- We document what each agent does, which data it uses and who is accountable, ready for your auditors
- We don't hold formal security certifications today, and we won't pretend to. We will answer your questionnaire in full.
Ownership and exit
- You own the code, prompts, workflows, test sets and documentation
- Everything lives in repositories and accounts you control
- Built on open standards and mainstream tools that other engineers know
- If you leave, we hand over cleanly and help your next team get started
Responsible disclosure
Found a weakness? Tell us first.
Email info@xdteknika.com with the details. We'll confirm receipt within two working days, keep you updated and credit you if you'd like.
Your move
Bring us the job nobody wants.
Thirty minutes, one process, and a straight answer on whether an agent should take it on. No slides and no obligation.