AI Usage & Data Processing Policy

1. Purpose and Philosophy Northwind Studio engineers custom artificial intelligence agents, large language model (LLM) pipelines, automated data workflows, and machine learning systems for client organizations.#

This policy defines our technical commitments regarding client data confidentiality, privacy safeguards, model safety, and code provenance when engineering AI-enabled systems.

2. Zero Foundation Model Training on Client Data We maintain a strict foundational policy regarding client intellectual property:#

• No Public Model Training: Northwind Studio does NOT use client proprietary data, source code, internal documents, database records, or communications to train, retrain, or fine-tune public foundational models.
• Zero-Data-Retention APIs: Where client solutions leverage commercial LLM APIs (such as Azure OpenAI Service, AWS Bedrock, or Google Cloud Vertex AI), we configure enterprise endpoints with zero-data-retention (ZDR) agreements ensuring customer data is never logged, cached, or utilized for provider model improvements.
• Private & Air-Gapped Deployments: For sensitive enterprise use cases, we design private VPC-isolated deployments using self-hosted open-weights models (such as Llama or Mistral) running within the client's own cloud perimeter.

3. Engineering Rigor and AI Code Verification While our software engineers may utilize modern developer-assistance tooling to accelerate delivery, we enforce strict human accountability:#

• Mandatory Human Peer Review: Every line of code generated or assisted by AI must undergo manual code review by senior engineers prior to pull request approval.
• Automated Security Testing: All codebases pass automated static application security testing (SAST), dependency scanning, and comprehensive unit/integration test suites.
• Licensing Compliance: We prohibit ingestion of code snippets subject to viral copyleft licenses (e.g. GPL) into proprietary client applications without explicit client consent.

4. AI System Safety, Guardrails and Evaluation When building customer-facing AI agents and LLM applications for clients:#

• Guardrails: We integrate deterministic validation layers, content filtering, and prompt-injection safeguards.
• Grounding & RAG: Systems utilize Retrieval-Augmented Generation (RAG) tied to verified client knowledge bases to prevent hallucinations.
• Human-in-the-Loop: High-stakes automated decisions (financial transactions, healthcare suggestions, legal verifications) are architected with mandatory human confirmation workflows.

5. Intellectual Property and Deliverables Ownership All custom AI models, fine-tuned weights, embeddings databases, evaluation harnesses, and orchestration software developed for a client under a signed Statement of Work are transferred in full to the client upon invoice settlement.#

For inquiries concerning our AI governance or custom security architectures, contact support@northwindstudio.tech.