What we do with your data, and what we never do.

In your own cloud account, in the region you choose, under your own encryption keys. The system is deployed into your tenancy. After handover, no component runs on Radexus infrastructure and no client data is stored on it. During discovery, read access is scoped narrowly, time-boxed and revoked at the end of the fortnight.

No, and it is not an architectural possibility rather than a policy promise: there is no shared tenancy, no shared store and no shared index. Each client instance is separate infrastructure in separate accounts. What we carry between engagements is method: connector code, resolution logic, evaluation harnesses. Never data, never patterns learned about you.

No. Not ours, not a provider's. Providers are configured with training opt-out where it is offered and avoided where it is not. This is contractual, not a setting, and it survives a change of provider.

PII is masked at extraction. Contact details are tokenised before any model sees them, so a name or a phone number is replaced by a reference that only your instance can resolve. Row-level access is enforced when data is read rather than at the screen, so a dealer or a rep can only ever see their own accounts.

Our engineers hold a builder role: they can change how a play works, and they cannot approve a write into any system of record. Role separation is enforced in your identity provider, not in our policy document. Access after handover is limited to what the assurance agreement names, and is revocable by you at any time without our involvement.

Four controls in sequence. A dry run showing the exact diff before anything is enabled. A named approver, set per play, per field and per value threshold. A complete audit trail with the prior value retained. A thirty-day rollback window your team can execute without us. No write path exists that bypasses all four.

Three, and they can be mixed per step within one play. A frontier model pinned to an in-region endpoint. A sovereign provider with EU or Indian residency by design. Open-weight models running inside your own VPC where nothing leaves your tenancy at all. Air-gapped deployment is possible where the policy requires it.

Because the system runs in your environment on your data, you remain the controller and we act as a processor under the terms of the signed agreement. We support deletion and access requests through the same lineage that makes numbers traceable: if a record was read, we can show where it went. Data processing agreements and standard contractual clauses are executed before discovery begins, not after.

Run logs on your schedule, seven years by default where audit requires it. Prior values on written fields for thirty days. Knowledge itself carries a half-life, so stale claims are held out of decisions rather than silently reused. Every retention period is a setting you own after handover.

The system keeps running. It is deployed in your account, licensed to you perpetually and irrevocably, with no licence server, no phone-home and no kill switch. Source escrow is available where your legal team requires it, and the stack is deliberately ordinary so that another firm could pick it up.

It should, and you should run one. There is no Radexus-hosted surface to test after handover: what your testers are assessing is an application in your own cloud, behind your own identity provider, with your own network controls. We will support the test and fix what it finds as part of the build.

Anything where a model's output affects a person without a human in the path: clinical decisions, credit decisions, employment decisions. Write-back always has a named approver, and the approver is never us.