Data minimization
Use only the data needed.
We seek the smallest dataset needed to test or operate a workflow. Public-data prototypes are kept separate from customer-provided information.
Security & trust
Confidence starts with clear boundaries.
Your data, access, and security requirements belong in the first conversation. Specific controls are documented for each engagement before we access customer systems or confidential information.
Access control
Keep access purposeful.
Access to customer information and production systems is limited to authorized operators involved in the relevant engagement.
Transport security
Protect data in transit.
Public web applications are served over HTTPS. Integrations and data transfers should use encrypted channels supported by the relevant provider.
Secrets & credentials
Keep credentials private.
Secrets belong in server-side environments or secret-management systems. They must not be exposed in browser code, repositories, logs, or screenshots.
Logging & retention
Give retention a purpose.
Logging should support reliability and security without collecting unnecessary personal or confidential data. Retention periods are defined for the engagement.
Third-party providers
Make dependencies visible.
When a pilot uses hosting, model, email, analytics, or data providers, the relevant dependencies and material data flows should be documented.
Responsible reporting
Tell us about a concern.
Report security concerns related to BZ Labs websites or systems directly to our support address.
support@bz-labs.comCertification status
BZ Labs does not claim SOC 2, ISO 27001, HIPAA, PCI DSS, or another formal certification unless that certification is explicitly documented on this site.
Discuss any procurement or certification requirements before committing to an engagement.
Let’s make it work
Let’s scope the controls, too.
Tell us about the data and security requirements your workflow needs to meet.