Data and AI Governance Policy
How XONIK governs the data it holds and the AI it uses: who is accountable, what we see, who may see it and what happens when an engagement ends.
Contents
Summary
We ask clients only for the access an engagement needs, put in writing the systems we may enter and the people who may read our notes, and work under an NDA. Accountability for data and AI sits with named people.
What this policy covers
This policy covers the data XONIK handles in its own operations and in client engagements, and the AI XONIK uses in that work. The AI Use Policy describes how AI is used, the Security policy describes the protections, and the Privacy Policy covers personal data collected through this website.
Who is accountable
The statement of work names the person on the client's side who owns the data we are given access to. At XONIK one named senior practitioner is accountable for each engagement, including for how its data is handled and for any AI used in it. Accountability does not rest with a tool or with a team in general. It rests with a person whose name is in the scope.
What we see and who may see it
We ask only for the access an engagement needs. The statement of work records the systems and papers we may see and the people at XONIK who may read our notes. Access ends when the engagement ends. Every engagement is under an NDA. A client can ask at any time who has had access to its information, and we will say.
Our role in relation to personal data
When we work with a client's personal data, the client decides why and how it is used and we act on its instructions. Where the law requires a written data processing agreement, we sign one. We do not use a client's personal data for our own purposes, and we do not combine it with information from other engagements.
Where client data is kept, and when it is deleted
The statement of work says where client information is held and what happens to it when the engagement ends. Client information is kept only as long as the work needs it. At the end, the statement of work says whether it is returned, deleted or kept for a stated reason, and who confirms that this has been done.
Governing AI
Our tools on this website are rule-based, and their scoring is published. Where AI is used in an engagement, the scope names it, a named person is accountable for its output, and a person reviews the output before anyone relies on it. The AI Use Policy sets out the rules in full. A client's data is not used to train a model unless the client has agreed to that in writing.
If something goes wrong
If a data incident affects a client's information, we tell the client as the statement of work and the law require. We say what happened, what information was affected and what we are doing about it, and afterward we record the incident and what we changed because of it.
Questions about this policy
To ask about data and AI governance, write to privacy@xonik.com
Questions about this policy?
Write to us and a person replies. For a security issue, use the responsible disclosure page.