Governance & Compliance

1. How SEALED Is Governed

• Source-grounded outputs. SEALED is designed to ground its answers in the client's own documents and procedures, and to point back to the source behind each output so a person can check it.
• Professionals stay in charge. SEALED supports decisions; it does not make them. Output is a draft, a finding or a flag for a licensed professional to review. Clinicians, attorneys, agents and consultants remain responsible for the judgment and work product they sign or send.
• Traceability. User and AI actions are recorded in audit logs so outputs and activity can be reviewed after the fact.
• Open-weight models, self-contained. Each deployment runs open-weight and open-source models on the client's own dedicated environment. SEALED does not send client data to third-party model APIs.
• No training on client data. Client documents are not used to train, tune or improve models for any other client or party.
• Defined boundaries. What data SEALED can access, and how it is organized, is documented with the client before deployment.

2. Regulatory Update Pipeline

SEALED can sync with publicly available government and regulatory sources so that guidance stays current.

• Updates are collected and applied automatically. A person does not review each update before it reaches the system.
• Source material can be incomplete, delayed or later corrected.
• Users should verify any regulatory point that matters to a decision against the authoritative source.

We state this plainly because automated currency is a strength, and unreviewed automation is a limit. Both are true.

3. Client Data Governance

• Client data is handled only on the client's instructions under a written agreement.
• Every client has a single-tenant deployment. There are no shared databases and no data movement between clients.
• Access is controlled by role, with ethical walls and data partitions available for conflicted or restricted matters.
• Clients keep their vector store and may take it with them. They have 30 days after the engagement ends to port it.
• When the engagement ends, the infrastructure and our pipelines are destroyed, and databases, including PostgreSQL, are deleted. HoomanKind does not keep clients' raw source data.

4. People

• HoomanKind staff and contractors who may touch client environments are bound by confidentiality agreements.
• Work inside a client's environment is performed under that client's permissions and leaves an audit trail.

5. Professional Responsibility

HoomanKind is not a law firm, medical practice, insurance agency or advisory firm, and does not give professional advice. SEALED is designed to support practitioners in meeting duties such as competence, confidentiality and supervision when they use technology and automated tools. Each practice is responsible for its own compliance with the rules of its profession and jurisdiction.

6. Compliance Status

We are honest about where we are.

"In progress" means work is underway. It is not a certification or a guarantee. We will update this table as milestones are reached. Clients subject to HIPAA or similar rules should address their requirements in the agreement before any protected data is loaded.

7. Vendor Management

Our deployments rely on a small number of infrastructure providers, currently Amazon Web Services for client environments and Cloudflare for our website. We review providers for security and confidentiality commitments suited to the data involved. A current provider list is available to clients on request.