Trust and security
Governance is something you can read.
The controls that make an AI system deployable are part of the build, not a policy written afterwards. Here is what ships with a Naivolabs deployment, how we handle data, and the claims we deliberately do not make.
Shipped with every deployment.
Role-scoped access
Retrieval and actions follow the role of the person asking. A student and a faculty administrator do not see the same corpus.
Confidence thresholds
The system only acts unattended above a threshold agreed with you. Below it, the case routes to a person instead of being guessed at.
Approval gates
Anything with a financial or contractual effect requires human approval. That is a permission, not a prompt instruction.
Immutable audit trail
Every automated decision is logged with what it saw, what it did and why, reviewable months later.
Evaluation as a release gate
A regression suite runs before each release. A build that regresses on the agreed test set does not ship.
A kill switch you control
You can stop the system without needing us. That is part of the handover, not an upsell.
How we handle data.
Data protection by design
We build against the Kenya Data Protection Act 2019 and the ODPC’s guidance, and we map personal data through a deployment before it goes live: what is collected, where it sits, who can reach it and how long it is kept.
Data minimisation
A system processes the fields the work actually needs. A document pipeline does not keep the whole document because it is easier.
Processor agreements
Engagements run under a written data-processing agreement covering purpose, retention, sub-processors and deletion.
Your environment, your data
Systems run in your environment or on infrastructure you control. Your data stays yours, and the code and configuration are documented and handed over.
What we will not claim.
The category has a credibility problem: claims run ahead of evidence. These are the claims we deliberately do not make.
- We do not claim an ISO or SOC certification before it is audited. When one is passed, we publish which one and when.
- We do not publish accuracy percentages without the harness that produced them.
- We do not make multi-country data residency claims that are not contractually backed.
- We do not take clinical or safety-critical work.
- We do not name a client, or show a logo, without that organization’s written approval.