We build inside your environment. Your data never has to come out.
The safest copy of your data is the one that never gets made. Our default is to work inside your cloud tenant or on your premises, under your identity provider and your logging, with a small team of US-person employees who have passed background checks. This page describes the controls in plain terms, including what we will never do.
Our default: we come to the data
Most data-labeling arrangements start by exporting records to the vendor. We start the other way around. Our people get named accounts in your environment, and the work happens where the data already lives.
In your cloud tenant. Your team federates our accounts through your identity provider, grants least-privilege roles in AWS, Azure or Google Cloud, and sees every action in your own logs. Annotation tools, notebooks and pipelines run inside your account.
On your premises. For records that can't be reached remotely, we work on a workstation at your site or on an isolated network segment, with no cloud services involved.
In a dedicated environment we operate, only if you ask. Some clients prefer that we host the workspace. When that's agreed in writing, it is single-tenant, in a US region, encrypted with keys you control, and torn down at project close.
Controls at a glance
What we do in each area, and how you can check it rather than take our word for it.
| Area | What we do | What you can check |
|---|---|---|
| People | Everyone who touches client data is a US person employed by Benner House, background-checked before access, bound by a written confidentiality agreement, and trained on security and privacy every year. Health projects add HIPAA training. No crowd workers, no offshore subcontractors. | A personnel letter for your project listing each person, their role and the date of their check; your own screening process where your rules require it |
| Access | Named individual accounts only, never shared. Least privilege, read-only to source systems wherever the task allows, time-boxed to the project, reviewed monthly, and removed the same day someone leaves the project. | Your identity provider's account list and access logs |
| Identity | Single sign-on and phishing-resistant multi-factor authentication with hardware security keys on every staff account. | Authentication events in your identity provider |
| Devices | Company-managed laptops with full-disk encryption, device management, endpoint detection, automatic updates and removable storage blocked. No personal devices. Client records are not stored on laptops; work happens in your environment or a virtual desktop. | Device posture through your conditional-access policies, where you use them |
| Encryption | TLS 1.2 or higher in transit. At rest, data stays in your storage under your keys. Any environment we operate at your request uses keys you control. | Your key management and storage configuration |
| Logging | In your tenant, every action lands in your logs. Our own identity and device logs are retained for at least a year and shared on request during an investigation. | Your cloud audit logs; our log extracts on request |
| Retention and deletion | Working copies deleted within 30 days of project close, followed by a written deletion record listing each location, the method and the date. We keep business records of the engagement, never client records. | The deletion record, and your own logs showing our access removed |
| Incidents | We notify you within 72 hours of confirming a security incident affecting your data, as a contractual commitment, or sooner if your agreement or BAA requires it. | The notification clause in your agreement |
| Subprocessors | None for data handling by default. Any third-party service that would touch your data, including a model API, is used only with your written approval and under your account. | The subprocessor list in your agreement, which is empty unless you add to it |
What we will and won't do with your data
We will
- Use your data only for the project you hired us for
- Keep it in your environment unless you decide otherwise in writing
- Tell you who has access, and remove access the day it's no longer needed
- Delete our working copies within 30 days of close and give you the record
- Tell you within 72 hours if something goes wrong
We will never
- Train any model for anyone else on your data, or on anything derived from it
- Use your data to improve our own tools, prompts or rubrics for other clients
- Send your data to a third-party model API under our account
- Let crowd workers or offshore contractors see it
- Keep "anonymized" copies, sell it, or share it
- Describe your project publicly without your written permission
Health data, BAAs and regulated records
We sign business associate agreements for any work involving protected health information, and we apply the minimum-necessary principle when scoping access. For other regulated records, such as nonpublic personal information at a financial institution, BES Cyber System Information at a utility, or export-controlled technical data, we follow the access rules your program sets, including your own personnel screening where it applies.
We'll complete your vendor security questionnaire in writing and walk your security team through each control on this page with evidence. This page doesn't list audit reports or attestations; ask, and we'll tell you exactly where we stand. Benner House is not a law firm and does not provide legal advice.
How security is set up on an engagement
Security review
Before any access, your security team reviews our controls, questionnaire answers and personnel letter. We agree in writing where the work happens and what may leave your environment.
Provisioning
Your team creates named accounts with the roles the task needs, through your identity provider. We confirm each person's access matches the plan before work starts.
Working period
Access is reviewed monthly and changes appear in the weekly readout. Anyone who leaves the project loses access the same day.
Close-out
We hand over the deliverables, you remove our accounts, we delete any working copies, and you receive a written deletion record within 30 days.
Security questions
Can you work in an isolated or on-premises environment?
Yes. We can work entirely on workstations at your site or on an isolated network segment. Setup takes longer, and for operational data it is often the right choice.
Do you use AI models on our data?
Only models that run in your environment or through accounts you control, and only for the project, such as pre-labeling or a baseline fine-tune. We never send your data to an outside model service under our own account.
Do you use subcontractors?
Not for anything that touches your data. Everyone with access is a Benner House employee, including the domain experts from our expert network, who are part-time employees under the same checks and agreements.
Where are your people?
In the United States: at our office in Jackson, Mississippi, and working remotely from elsewhere in the country. Remote staff follow the same device, identity and access controls.
Can we audit you?
Yes. We accept reasonable audit rights in our agreements and will provide evidence for any control on this page. Security questions can go to privacy@bennerhouse.com or through our contact page.
Related services and reading
Bring us one messy data source and one question.
Tell us what the data is and what you want a model to do with it. A data engineer, not a salesperson, will reply within one business day with questions and a proposed first step.