Security

Data handling, stated plainly

We have no production operators and no security certifications. This page describes the product design (requirements v0.3) and says what is still to be confirmed. It is not a certification or an audit report.

The system of record stays yours

Decisions write through an executor to your platform (PAM or back office). The cockpit does not keep its own copy of money state. The executor carries rate limits, a kill switch and an audit log. If the cockpit or a model provider is down, your back office keeps working and agents stop at the safety floor.

GDPR and the DPIA

Player data is personal data. A data protection impact assessment is a precondition for the first release to an operator, and the cockpit is built around data minimisation. We are still taking legal advice on how the EU AI Act classifies the agent fleet and any staff analytics, and we will tell staff about staff analytics in any case. Every agent action that affects a player gets a per-customer review and a contest route for the player (GDPR Art. 22).

Role-scoped views

Each person sees only what their role needs. A VIP host or CRM manager does not see AML detail. MLRO data sits in a need-to-know compartment, and players under compliance review are handled so that nothing tips them off.

Audit

• Every autonomous action and every human decision is logged, with a reason code on human decisions.
• Shift handovers are signed. The action ledger is tamper-evident and exportable, and the export verifies against hashes.
• Records of exchanges with the Advise mode are kept for five years.

Model providers and hosting

Not yet fixed. Because we have no production deployment, we publish no provider or sub-processor list. For a pilot we agree the model provider, hosting region and data-processing terms with you in writing before any of your data is processed, and we keep a record of every agent exchange.

Human control

Anyone can pause the fleet and only a named owner can resume. New actions stop within 30 seconds and actions in flight finish or roll back. Self-exclusion and harm restriction continue to run and fail closed. A self-exclusion register outage means no play and no marketing sends to that market.

Reporting a security concern

Email hello@aipitboss.com.