Legal & Compliance
Security Practices
How we secure our infrastructure, handle client data, and respond to incidents.
Security Practices
Effective Date: March 1, 2026 Last Updated: March 1, 2026
Draft Notice: This document is a working draft describing our current security posture and practices. It is provided for transparency and vendor due diligence purposes.
1. Overview
Integral Business Intelligence takes a security-first approach to AI systems integration. Our entire value proposition is predicated on the premise that organizations can use powerful AI without surrendering control of their data. This document describes the security practices we apply to our own operations and infrastructure.
We are a small, technically-focused organization. We do not claim the same posture as a Fortune 500 enterprise, but we take security seriously and continuously improve our practices.
2. Infrastructure Security
2.1 On-Premises Inference
Our core AI inference workloads run on hardware we own and physically control in our facility. This architecture eliminates the risk of client data traversing public cloud AI infrastructure.
- Physical access: Server hardware is located in a secured, access-controlled environment.
- Network isolation: AI inference endpoints are segregated on dedicated network segments, isolated from public internet exposure.
- Perimeter protection: Cloudflare Tunnel is used for public-facing web traffic, preventing direct exposure of our server's IP address to the public internet.
2.2 Web Infrastructure
- HTTPS/TLS: All public-facing traffic is encrypted in transit using TLS 1.2 or higher, enforced via Cloudflare.
- DDoS protection: Cloudflare provides DDoS mitigation for our public web properties.
- Rate limiting: Application-level rate limiting is applied to API endpoints (including AI inference APIs) to prevent abuse.
3. Access Controls
- Principle of least privilege: Access to internal systems is granted on a need-to-know basis. Employees and contractors receive only the permissions necessary for their role.
- Authentication: Administrative access to critical systems requires strong authentication. Where possible, multi-factor authentication (MFA) is enforced.
- Remote access: Remote administrative access is secured and logged.
4. Data Handling Security
- Data minimization: We collect only the data necessary to provide services.
- No public cloud AI routing: Client data processed through our AI systems runs locally. We do not transmit client data to third-party AI APIs (e.g., OpenAI, Google Gemini) as part of our standard service without explicit client consent.
- Encryption at rest: Sensitive data stores are encrypted where feasible.
- Database access: Our PostgreSQL database is not publicly accessible and is accessible only from within our internal network.
5. Vulnerability Management
- Dependency updates: We maintain a practice of regularly reviewing and updating software dependencies across our products and infrastructure.
- Security patching: Operating system and server software patches are applied on a regular cadence.
- Code review: Security considerations are part of our development and deployment process. We avoid common vulnerability classes (OWASP Top 10) in our custom software.
6. Incident Response
In the event of a suspected security incident:
- Detection: Anomalous activity is identified through monitoring and logging.
- Containment: Affected systems or accounts are isolated to prevent further exposure.
- Assessment: We determine the nature and scope of the incident.
- Notification: Affected clients are notified within 72 hours of confirming a breach involving their data, as described in our Data Processing Addendum.
- Remediation: Root cause is identified and addressed. Processes are updated to prevent recurrence.
7. Employee and Contractor Practices
- All personnel with access to client data are made aware of their data handling responsibilities.
- Contractors operating under client engagements are subject to confidentiality obligations.
- Departing personnel have access promptly revoked upon separation.
8. Client-Side Security Guidance
When we deploy solutions on client infrastructure, we provide guidance on:
- Network segmentation for AI inference endpoints.
- Access controls for knowledge bases and AI-integrated applications.
- Audit logging for AI query activity.
- Update and patching cadence for deployed software components.
Our goal is to leave client environments more secure after an engagement, not less.
9. Third-Party Services
We use a limited set of third-party services for operational purposes:
| Service | Role | Security Notes |
|---|---|---|
| Cloudflare | Network security, CDN, tunnel | Handles perimeter security; subject to Cloudflare's security posture |
| Stripe | Payment processing | PCI DSS compliant; we do not store payment card data |
10. Certifications and Assessments
Integral BI does not currently hold formal security certifications (e.g., SOC 2, ISO 27001). We are a small business and maintain security practices commensurate with our size and the nature of our engagements. Clients in regulated industries with formal vendor security requirements should discuss their needs with us directly so we can assess whether we can meet them.
11. Responsible Disclosure
If you discover a security vulnerability in our website or services, please report it responsibly:
Email: [email protected]
Please provide a description of the issue, steps to reproduce, and potential impact. We will acknowledge receipt within 48 hours and work to address confirmed vulnerabilities promptly.
12. Contact
Integral Business Intelligence Email: [email protected] General: [email protected]
Questions about this document? Contact us at [email protected]