Operational data is some of the most sensitive data in your business. We treat it that way. Our security and governance practices are designed for regulated, audit-heavy environments, even when the engagement is not regulated.
Processing standards
The single most common question we get from CIOs and CISOs is about AI processing. Our answer is direct: we do not rely on external AI models for processing sensitive client data. All analysis is performed within controlled and secure environments with strict data-governance principles.
Standard / 01
We do not rely on external, public, or third-party AI models for processing sensitive client data. All analysis is performed within controlled and secure environments with strict data-governance principles.
Standard / 02
Process-mining transformations, queries, and reporting run inside governed environments, either Alkhai's own SOC-aligned environment or a client-controlled tenant where required.
Standard / 03
Data minimization, purpose limitation, retention boundaries, and disposal procedures are documented and reviewed for every engagement.
Standard / 04
Because every finding traces to specific events, our outputs themselves serve as defensible process evidence in regulated environments.
Data security
These are baseline, not premium tier. They apply to every engagement, regardless of size or industry.
All data in transit is encrypted with TLS 1.2+. All data at rest is encrypted with AES-256 in customer-controlled storage where required.
Access to client data is strictly role-based, time-bounded, and fully audited. Practitioners only see what they need to deliver the engagement.
Where client policy requires, all analysis runs inside the client's tenant or VPC. We meet you where your security policy already lives.
We work with the minimum data required to answer the operational question, no more. PII is masked, hashed, or excluded by default.
Every transformation, every query, and every export is logged. Engagements end with a complete, defensible processing trail.
We sign mutual NDAs before scoping. We sign DPAs before any data flows. There is no informal phase.
We provide a full security questionnaire response and DPA on request, including subprocessor list, data-flow diagrams, and incident-response procedures.
The Alkhai Diagnostic
The core analysis and delivery is completed within 2 to 4 weeks of data connection. We surface the biggest hidden bottlenecks, identify which segment is driving each one, and deliver a ranked action plan with quantified ROI. After delivery, we can support execution of specific constraints where needed. The plan is complete and ready to act on.
