Security and data
How we handle your information.
Clients trust us with how their organization really works. These are the practices we follow with that information, on every engagement.
Our commitments
- Confidential from the first conversation
- What you tell us about your organization is confidential from the first discussion. We will sign your non-disclosure agreement before you share details, or provide our own.
- Your data stays yours
- Information you share is used only for your engagement. We do not sell it, share it with other clients, or use it to train AI models.
- Outside AI services, named in advance
- Before any of your information is sent to an outside AI or cloud service, we tell you which service, where the provider says the data is processed, and on what terms. Where a service offers settings that stop it keeping your data or training on it, we use them. If you require your data to stay in Canada, we design for that and tell you plainly if a service cannot meet it.
- Least access, named people
- We ask only for the access the work needs, under named accounts, never shared ones. Firm accounts are protected by multi-factor authentication. Access is removed when the work ends, and we confirm it in writing.
- Security built into what we deliver
- Passwords and keys are kept out of source code. Systems are tested before they reach your team, and the software they depend on is kept up to date while we support them. Every handover includes documentation of how the system is secured.
- Personal information
- Where a project involves personal information, we agree with you at the start how it will be collected, used, stored and deleted, with Canadian federal and provincial privacy law in view.
- End of engagement
- When the work is complete, we return or delete your information as agreed and confirm in writing that it has been done.
- If something goes wrong
- If we become aware of a security incident affecting your information, we tell you promptly, explain what happened and what we are doing about it, and meet our legal reporting obligations.
What we do not claim
NLM Cognitive Solutions does not currently hold SOC 2, ISO 27001 or any other security certification, and we do not display badges we have not earned. If your organization requires a particular certification or security questionnaire from its suppliers, tell us at the start. We will answer it fully and say plainly where we do not meet a requirement.
Security reviews
Security reviews of NLM Cognitive Solutions' own systems, and of the solutions we deliver to clients, are carried out with FlintLever, the security and compliance company of our group. Both brands are part of FlintLever Inc., which answers for the work.
The terms of each engagement
The handling of your data is written into the agreement for each engagement, alongside scope, price and ownership of the work. Where those terms differ from this page, the agreement governs. For information collected through this website, see our privacy notice.
Questions
Write to hello@nlmcognitive.com. We will answer security and privacy questions before any engagement begins.