Dataprotectioncontrols,andthequestionsonlyyoucananswer
A platform can supply technical and organisational measures. Lawful basis, necessity and proportionality are determinations for your own data protection function.
Technicalandorganisationalmeasures
Residency enforcement
Region and infrastructure class enforced for data, indexes, evidence, backups and model inference.
Data minimisation
Scoped retrieval and edge processing so that only what is needed reaches a model.
Access-aware retrieval
Retrieval respects the caller's permissions, so an index cannot become a permission bypass.
Purpose limitation
Agent mandates bind data scope to a declared purpose rather than to whatever credentials reach.
Records of processing
Decision records showing what was accessed, by which principal, for what purpose and when.
Retention
Configurable retention for evidence, indexes and derived artefacts, with deletion that propagates.
Redaction
Sensitive spans removable before content reaches a model, with the redaction recorded.
Key custody
Customer-held encryption keys, including the root of trust in private postures.
No training on customer data
Customer data is not used to train shared models.
Subprocessor transparency
Current list, purpose and posture, maintained per deployment and available on request.
Data subject requests
Support for locating and deleting personal data across indexes, evidence and derived artefacts.
Deployment without external processors
Postures where no third party processes the data at all.
NeuroCluster is designed to support the technical and organisational measures a controller needs. Lawful basis, necessity, proportionality, transparency to data subjects and impact assessment remain determinations for your organisation, made with your own legal and data protection advice. A deployment-specific assessment remains required.
Questions
- Can personal data be processed entirely within our own infrastructure?
- Yes. On-premises and disconnected deployment with locally hosted models means no personal data leaves your boundary for inference or retrieval.
- Do you sign a data processing agreement?
- Yes, where NeuroCluster acts as a processor. In customer-infrastructure postures the processing relationship can be materially narrower, which is worth establishing early.
- How are data subject deletion requests handled?
- Deletion propagates to indexes, derived artefacts and evidence, subject to retention obligations that may require records to be kept. Where those conflict, the conflict is yours to resolve with legal advice, and the platform is built to make either outcome executable.
Bring us one operational problem.
You do not need a finished brief. Bring the problem — we will work out the next step together.
Or book a call with the team