---
title: "Security and data | Chainfore"
url: https://chainfore.com/company/security
updated: 2026-10-22
summary: "We document control in six layers and agree each one in the contract."
---

Security, data and deployment

# Hosting location does not settle who can access data.

We document control in six layers and agree each one in the contract.

- L1 Deployment boundary. Production, backup, model-provider, log, telemetry and disaster-recovery locations documented.

- L2 Operator access. Client-approved accounts; least privilege; multi-factor authentication; time-limited access; session logging where appropriate; no shared production credentials.

- L3 Development data. Synthetic or minimised test data. We do not assume de-identification removes privacy obligations.

- L4 Training and retention. No training or product improvement on customer data unless explicitly authorised; model-provider handling, retention and deletion specified.

- L5 Contracting and IP. Written scope; confidentiality; foreground and background IP; subcontractors; termination assistance; approved data flows.

- L6 Restricted work. Sector, geography and procurement restrictions checked before access is accepted. We decline work the proposed model cannot lawfully or operationally support.

## Deployment options

- Client-hosted. Software and artefacts run in your cloud, with controlled supplier access.

- Managed tenant. An isolated service with agreed providers and controls.

- No-production-access engineering. We build on synthetic data; you operate production.

## Per-engagement documents

Every engagement produces a data-flow diagram, a threat model, and a model and provider register. They are yours.

## Reference frameworks

We use NIST AI RMF, the OWASP Top 10 for Agentic Applications and ISO/IEC 42001 as reference frameworks for our method. Using a framework is not certification against it; see Trust and compliance for what is held.

## Cross-border note

The European Commission's adequacy decisions do not list Pakistan as of this review. That does not by itself prohibit a transfer, but a lawful mechanism and an assessment may be needed. Your counsel determines the applicable obligations. This page is an engineering and procurement checklist, not legal advice.

## Reporting a vulnerability

info@chainfore.com.