How Engai Technologies Inc. protects enterprise customer telemetry, raw sensor datasets, human annotation outputs, and website visitors under SOC 2 Type II, HIPAA, and GDPR standards.
We Never Train Foundation Models on Your Proprietary Data.
Engai enforces a strict cryptographic wall between client datasets and model training. Your raw sensor captures, labeled polygons, clinical DICOM slices, and fine-tuning conversation logs are strictly isolated to your tenant and deleted upon pipeline completion.
1. Customer Data Sovereignty & Model Training Ban
Engai Technologies Inc. (“Engai”, “we”, “us”, or “our”) provides high-throughput data annotation, dataset curation, model fine-tuning validation, and human-in-the-loop AI infrastructure. We recognize that customer training datasets represent high-value trade secrets and proprietary intellectual property.
Zero Cross-Tenant Contamination: All data submitted via our streaming APIs, S3 connector buckets, or WebGL workstations is logically separated using tenant-isolated KMS cryptographic keys. We do not aggregate customer data across organizations, nor do we utilize customer data to pretrain, fine-tune, or benchmark our own internal models or third-party foundation models without explicit written permission.
2. Information We Collect & Ingest
Depending on your interaction with the Engai platform, we process the following categories of information:
Commercial Account Telemetry: Name, work email address, phone number, company affiliation, job title, invoicing details, and SSO authentication credentials when you create an enterprise workspace.
Customer Workload Artifacts: Multimodal files uploaded for human annotation or automated QA—including 2D image formats (JPEG, PNG, TIFF), temporal video feeds (MP4, AVI), 3D point clouds (PCD, LAS, PLY, E57), volumetric medical series (DICOM), and text/JSON corpus.
Operational Metadata: Timestamp logs, API endpoint latency, bounding box coordinates, annotator consensus variance scores, task completion durations, and audit trail records.
Website Analytics: If you enable analytics, first-party browser storage identifiers record page views, time spent with a page in view, referring sites and campaigns, clicked links, device category, and approximate country, region, or city when available from our hosting provider. The analytics event store does not retain raw IP addresses or full browser user-agent strings.
3. Data Handling in Human-in-the-Loop Workflows
Human annotation requires rigorous operational controls to prevent unauthorized data exfiltration:
Restricted Workstation Virtualization: Annotators operate within locked, browser-based WebGL environments with clipboard copying, local saving, screen recording, and external USB storage disabled.
Strict Non-Disclosure Agreements (NDAs): Every annotator, QA specialist, and domain expert (including licensed radiologists and roboticists) executes legally binding confidentiality agreements.
Automated PII Obfuscation: Before entering human labeling queues, autonomous vehicle imagery and street view telemetry undergo automated blurring of vehicle license plates and pedestrian facial features.
4. SOC 2 Type II, HIPAA & GDPR Frameworks
Engai maintains enterprise compliance across major global data privacy frameworks:
SOC 2 Type II
Audited annually across Security, Confidentiality, and Availability trust criteria.
HIPAA & BAA
Full compliance for Protected Health Information (PHI) with executed Business Associate Agreements.
GDPR / CCPA
Standard Contractual Clauses (SCCs) and complete data subject rights fulfillment mechanisms.
5. Encryption, Access Controls & Infrastructure
Our security architecture is designed to prevent perimeter breaches and internal unauthorized access:
Data in Transit: Encrypted using TLS 1.3 with automated certificate rotation and HSTS preloading.
Data at Rest: Encrypted using AES-256 via customer-managed keys (AWS KMS / HashiCorp Vault).
Zero-Trust Network Access (ZTNA): Administrative systems enforce hardware MFA (FIDO2 / WebAuthn) and least-privilege role segregation.
6. Authorized Subprocessors & Regional Data Centers
We partner with enterprise infrastructure providers who meet our rigorous security baselines:
Subprocessor
Purpose
Location
Amazon Web Services (AWS)
Cloud hosting, S3 bucket storage & KMS encryption
US / EU (Customer selectable)
Google Cloud Platform (GCP)
Distributed tensor compute & vector indexing
US / EU
Cloudflare
DDoS defense, edge WAF, and CDN routing
Global Edge
7. Cookies, Web Beacons & Telemetry Tokens
Engai uses first-party cookies to manage secure login sessions, remember UI theme preferences, and track aggregate pipeline performance. We do not sell your personal information or license browsing behavioral data to third-party data brokers.
You can adjust your cookie settings at any time by clicking the link in our footer.
8. Global Privacy Rights (GDPR / CCPA / CPRA)
Regardless of geography, all Engai customers and individuals whose data is processed retain statutory rights:
Right to Access & Portability: Request an export of your personal information in a structured machine-readable format.
Right to Erasure (“Right to be Forgotten”): Demand deletion of contact profiles and associated account records.
Right to Rectification: Correct incomplete or inaccurate commercial records.
Non-Discrimination: We do not alter pricing or service quality if you exercise statutory privacy rights.
9. Data Retention & Cryptographic Destruction
Customer dataset artifacts are stored only for the duration specified in the applicable Statement of Work (SOW). Upon project completion or customer termination, data undergoes cryptographic wipe in accordance with DoD 5220.22-M / NIST SP 800-88 standards, followed by a formal Certificate of Destruction upon request.
10. Data Protection Officer (DPO) & Inquiries
For privacy questions, HIPAA BAA requests, or regulatory inquiries, contact our Data Protection Office: