Framework01
NIST AI RMF
Govern, Map, Measure, Manage. We apply the NIST AI Risk Management Framework to every system we build: drift thresholds, bias monitoring, accountability and continuous mitigation.
Trust
The safest data is the data we never hold.
Our approach to privacy starts with architecture, not policy. Personal information is removed at the source, access is limited to what each task needs, and every action is logged. Here is exactly how.
- PII on Lapi serversNone
- Where de-identification happensOn your premises
- Access modelZero trust, least privilege
- EncryptionIn transit and at rest
- Agent actionsTyped, permissioned, logged
Data handling
How data moves, step by step.
This applies to every Data Exchange engagement, and to any service engagement where we work with sensitive records.
01
Raw data stays on site
Our team works on your premises, on your systems or on a dedicated device that never connects to our network while it holds raw data.
02
Personal information is removed
Direct identifiers, indirect identifiers, details inside free text, and voices or faces in audio and images. For healthcare data we follow HIPAA Safe Harbor or Expert Determination.
03
The result is tested
We check samples manually and run automated scans for residual identifiers and re-identification risk. Data that fails is reworked, not shipped.
04
You approve the release
Nothing leaves your site until you have reviewed the de-identification record and signed off.
05
Encrypted transfer and storage
De-identified data moves over encrypted channels to access-controlled storage. Every access is logged.
06
Contractual protection follows the data
Licensees are bound to no re-identification, no resale, approved uses only, and deletion at the end of the term.
Frameworks
Aligned with the standards serious buyers check.
We design our work around recognized frameworks so it fits into your security reviews and your auditors' expectations. Where a framework offers formal certification, we will tell you plainly whether we hold it.
Standard02
ISO/IEC 42001
Our delivery follows the structure of the AI Management System standard: AI policy, impact assessment, data governance and lifecycle controls.
Controls03
SOC 2 criteria
We operate to the Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy.
Healthcare04
HIPAA
De-identification to Safe Harbor or Expert Determination, and Business Associate Agreements for any engagement where our team handles PHI on site.
Federal05
NIST 800-53
Security controls aligned with NIST 800-53 Rev. 5, with government workloads deployed on FedRAMP-authorized cloud providers.
Privacy06
GDPR & US state privacy laws
Data minimization by design. Because data is de-identified at the source, what we handle is not personal data.
Security practices
How we run our own house.
- Zero-trust access: every request authenticated and authorized, no implicit trust between systems
- Least privilege: people and AI agents get only the access a task requires
- Multi-factor authentication on every Lapi account
- Encryption in transit (TLS) and at rest
- Every agent action is a typed, permissioned tool call with a complete audit log
- Secrets kept in managed vaults, never in code
- Background-checked staff for on-site work, bound by confidentiality agreements
- Documented incident response with prompt customer notification
Agreements
The paperwork, ready when you are.
- Mutual non-disclosure agreement
- Data processing agreement
- Business Associate Agreement (healthcare)
- Data license agreement (Data Exchange)
- Security questionnaire responses on request
Security questions
Ask us anything about how we handle data.
Send us your security questionnaire or your toughest question. A technical person will answer it, not a salesperson.