Legal

Security measures schedule

This schedule summarizes security measures for AI Team, operated by Akii Technologies, Ltd. It is a public summary and can be supplemented by signed enterprise terms.

Version and owner

Effective 2026-06-25. Owner: legal-compliance. Security evidence must stay aligned with launch readiness, provider governance, and production runbooks.

Security controls are reviewed before launch and before a client Agent handles live work.
Operator access, provider access, and model access must stay server-side and least-privilege.
Production readiness requires dated evidence, not public copy alone.

Access control

AI Team separates public pages, client dashboard access, operator tooling, internal workers, and service-role database operations.

Operator access requires approved roles and is checked server-side for protected actions.
Credential access reviews record owner, scopes, storage location, status, revocation path, expiry, and rotation evidence.
Break-glass, access review, and admin action evidence must be retained where configured.

Data minimization

Systems should store safe summaries, metadata, IDs, and evidence rather than raw private records whenever possible.

Public forms reject likely secrets and warn against private records and excluded regulated records.
Operator notes and runtime summaries must not include secrets, credentials, medical records, regulated finance records, or full customer exports.
Observability providers must receive redacted data or safe references only.

Monitoring and incidents

AI Team uses monitoring, audit records, run IDs, exception paths, and provider alerts to investigate failures.

Incident runbooks cover data exposure, wrong-recipient outbound errors, credential compromise, excluded-sector discovery, provider outage, and model-provider issues.
Agents can pause, throttle, escalate, or require approval when stop rules or safety thresholds are triggered.
Security incidents are handled according to the DPA, signed agreement, and applicable law.

Recovery and deletion evidence

Backup, restore, export, deletion, and legal-hold behavior must be evidenced before production launch.

Restore drills must verify schema, grants, RLS, Data API exposure, and critical data recovery.
Deletion handling must account for backups, logs, billing records, legal holds, and connected client systems.
Provider retention and support access must be recorded in subprocessor approval records.

Next step

Need help applying this policy?

Start with setup so AI Team can confirm the work, required access, approval rules, pass-through costs, and go-live requirements.

Start setup Contact AI Team

Version and owner

Effective 2026-06-25. Owner: legal-compliance. Security evidence must stay aligned with launch readiness, provider governance, and production runbooks.

Security controls are reviewed before launch and before a client Agent handles live work.

Operator access, provider access, and model access must stay server-side and least-privilege.

Production readiness requires dated evidence, not public copy alone.

Access control

AI Team separates public pages, client dashboard access, operator tooling, internal workers, and service-role database operations.

Operator access requires approved roles and is checked server-side for protected actions.

Credential access reviews record owner, scopes, storage location, status, revocation path, expiry, and rotation evidence.

Break-glass, access review, and admin action evidence must be retained where configured.

Data minimization

Systems should store safe summaries, metadata, IDs, and evidence rather than raw private records whenever possible.

Public forms reject likely secrets and warn against private records and excluded regulated records.

Operator notes and runtime summaries must not include secrets, credentials, medical records, regulated finance records, or full customer exports.

Observability providers must receive redacted data or safe references only.

Monitoring and incidents

AI Team uses monitoring, audit records, run IDs, exception paths, and provider alerts to investigate failures.

Incident runbooks cover data exposure, wrong-recipient outbound errors, credential compromise, excluded-sector discovery, provider outage, and model-provider issues.

Agents can pause, throttle, escalate, or require approval when stop rules or safety thresholds are triggered.

Security incidents are handled according to the DPA, signed agreement, and applicable law.

Recovery and deletion evidence

Backup, restore, export, deletion, and legal-hold behavior must be evidenced before production launch.

Restore drills must verify schema, grants, RLS, Data API exposure, and critical data recovery.

Deletion handling must account for backups, logs, billing records, legal holds, and connected client systems.

Provider retention and support access must be recorded in subprocessor approval records.