NeuralTide designs solutions around customer-owned infrastructure whenever appropriate, helping organisations retain control of business data, credentials and production environments. The customer owns:

• All business data
• The cloud account
• The production environment
• Credentials and access
• Databases and files
• Models, when customer-owned
• Infrastructure resources

Our team gets only the access the work needs, and you can revoke it at any time.

• Least-privilege access
• Role-based access control
• Temporary access for the engagement
• Immediate credential revocation
• Secrets management
• Environment isolation (dev / staging / production)
• Audit logging

Customer data is not used by NeuralTide to train models unless explicitly agreed.

• AI providers and model configurations are selected according to customer security, privacy, data-residency and operational requirements
• Zero-retention setups or private models can be designed, depending on the selected provider and deployment model
• Sensitive data can run on local LLMs or your own servers

Retention terms differ by provider; we state them in each project's design document rather than promising them across the board.

Systems run in environments the customer controls, without lock-in to a single provider.

• Public cloud
• Private cloud
• Hybrid
• On-premise
• Local AI

AI agents work within boundaries your organisation sets, and every action can be audited.

• Human-in-the-loop
• Approval gates
• Audit logs
• Evaluation
• Monitoring
• Permission boundaries
• Kill switch
• Escalation
• Retry policies
• Safety guardrails

AI agent autonomy levels

Architectures are designed with Thailand's Personal Data Protection Act (PDPA) in mind from the start.

• PDPA-aware architecture
• Access control
• Data minimisation
• Encryption
• Data-retention policy
• Customer-controlled environment

NeuralTide does not yet hold formal certifications such as ISO 27001 or SOC 2. We design to good practice and work under the customer's own security policies.