Minimise unnecessary data
Collect and move only the information needed for the workflow. Avoid creating extra copies of sensitive data without a clear reason.
Delivery principles
Security is an architecture decision.
The exact controls depend on the project, hosting environment, data and risk profile. These principles guide how SAWQ scopes and designs technical work.
Define access boundaries
Identify who can view, change or trigger sensitive actions and design permissions around those roles.
Keep secrets out of the browser
Credentials and privileged API keys belong in protected server-side environments rather than public front-end code.
Validate before action
Inputs, permissions and important state changes should be checked before a system creates, sends or modifies something consequential.
Plan for failure
Useful systems need fallbacks, clear error states and recovery paths instead of assuming every service or model call will succeed.
Keep dependencies visible
Third-party services, model providers and integrations should be understood so data flow and operational risk are not hidden.
Responsible AI
AI should know its role in the system.
A confident response is not the same as a reliable one. We design AI around approved context, limits and escalation paths where they are needed.
Grounded information
When an assistant must answer from organisational knowledge, retrieval can be restricted to approved sources and designed to show where information came from.
Human oversight
Important decisions and high-impact actions can require a human checkpoint rather than allowing generated output to act without review.
Evaluation before trust
Realistic test questions, edge cases and failure scenarios are more useful than judging the system by a few impressive demos.
Clear fallback behaviour
The system should know when to ask for clarification, decline, hand off or stop instead of filling gaps with unsupported confidence.
Appropriate logging
Operational visibility can help diagnose failures, but logging should be designed with data sensitivity and retention requirements in mind.
Provider awareness
Data handling should be mapped project by project, including what is sent to external model or platform providers and under which settings.
Important boundary
We do not imply certifications that have not been earned.
SAWQ does not present itself as ISO 27001, SOC 2 or otherwise certified unless and until a certification is formally obtained. Regulated, clinical, financial, legal or safety-critical use cases require project-specific governance and specialist review.
Questions we want answered before an AI or automation launch
- What data enters the system, and where does it go?
- Who is allowed to access each part?
- Which actions are reversible, and which are high impact?
- What happens when the model, API or integration fails?
- When must a human review the output?
- How will the system be tested after data, prompts or workflows change?
Scope it properly
Security requirements belong in the first conversation.
Tell us about the systems, data, users and constraints involved in your project.