Data handling
Where your content goes.
A standard Preflight sends your course content to an external AI provider. This page says which one, how long we keep anything, what we will sign, and how the restricted track works when your content cannot go to a commercial provider at all.
The short version
Two tracks, and you choose which one you’re on.
Standard track
Commercial AI processing
Course content → Actyra → Anthropic API
- Faster, and the analysis quality is what our published work demonstrates
- Standard Preflight methodology
- Provider terms disclosed, and confirmed for your project in writing
Restricted track
No commercial AI provider
Course content → agreed local environment
- Analysis runs locally in an agreed environment. Course content is not transmitted to Anthropic or another AI model provider
- The model is agreed with you before the engagement starts
- Slower, and scoped separately
The restricted track
Some training should never be sent to a commercial AI provider.
If yours falls into that category, it does not disqualify it from a Preflight. We can scope a restricted engagement using an agreed locally hosted model, with no course content sent to an external AI model provider.
What we say about the restricted track, and what we don’t
We do not name a single local model here, because the right one depends on your constraints rather than ours. We agree the model with you at scoping, and your security team has a veto.
Locally hosted open-weight models are not identical to a frontier commercial model. Once we have agreed which one, we will tell you where the analysis is likely to be thinner for that model specifically. If the difference would make the report not worth having, we will say so before you buy.
Federal, defense and controlled content
If your material is CUI, export-controlled, or otherwise restricted from commercial cloud processing, the standard track is not available to you and we will not quote it. Raise it at first contact so we scope the restricted track from the start.
Standard track
Who processes your content.
Our AI provider is Anthropic (Claude models), via the commercial API. Working storage and file transfer are disclosed during scoping, including every system that may process or store your content.
The terms below are set by the provider and can change, so this page links to them rather than restating them. Before an engagement begins, we confirm the terms applicable to your project in writing.
| Question | Current source |
|---|---|
| Training on your content | Commercial terms ↗ (opens in a new tab) |
| Retention | Commercial terms ↗ (opens in a new tab) |
| Zero-data-retention eligibility | Anthropic Trust Center ↗ (opens in a new tab) |
| Subprocessors and regions | Anthropic Trust Center ↗ (opens in a new tab) |
One distinction worth being precise about
“We don’t train on your data” and “nothing is stored” are two different commitments, and vendors routinely blur them. They are governed by different provider policies, both linked above, and we will tell you what each one says for your engagement rather than only the flattering one.
Your content is yours
How long we keep anything.
These are our own retention commitments, and they go into the engagement contract rather than living only on this page.
| What | How long |
|---|---|
| Your uploaded course files | 30 days after report delivery, then deleted. Sooner on request. |
| Your Learning Readiness Report™ | 12 months, so we can support a retest. Deleted on request. |
| Anonymized findings for benchmarking | Retained only with your written opt-in. Off by default. |
Provider-side retention is a separate question, governed by the policies linked above.
Procurement and legal
Paperwork we can complete.
- An NDA, mutual or one-way, before you send anything.
- A data processing agreement. We can execute a DPA covering processing instructions, confidentiality, subprocessors, retention and deletion. Where international transfer mechanisms are required, they are documented in the agreement.
- Your standard security questionnaire. We are a small firm; we will answer it accurately, including where the answer is “not applicable” or “we don’t have that.”
- Deletion confirmation in writing at the end of an engagement.
What we don’t have
We do not hold SOC 2, ISO 27001 or FedRAMP authorization, and we will not imply otherwise. If your procurement requires one of those, we are not now a fit for that engagement and would rather tell you now than at the end of a review cycle.
One thing worth understanding about the no-training term
Our provider’s commitments run to us, not to you. They only become yours to enforce once the corresponding term is in the agreement between us, which is why the commitments on this page go into the contract. Ask for the clauses before you sign and we will send them.
Need something stricter?
Talk to us before sending anything, so the right track is scoped from the start.
hello@actyra.com · +1 (407) 222-5432