Your data is yours. Here's how we protect it.

Where does your data live?

Every system runs on dedicated infrastructure, not a platform shared with other clients. We use Hetzner servers and the Cloudflare network, two providers whose data centers are certified to ISO/IEC 27001. If your policy requires it, the system can be deployed directly into an account in your company's name.

The database, the files and the source code are yours. At handover you get access to the infrastructure, the repository and the architecture documentation. If you decide tomorrow to work with another team, everything goes with you. There are no proprietary formats or licenses tying you down.

Who can see what?

• Role-based access. Each user sees and does only what their job requires. FUNCUAN's clinical system, for example, runs with 7 distinct roles, and field staff don't see what medical coordination sees.
• Audit trail. Changes to sensitive information are logged with user, date and time. When an auditor asks who modified a record, the system shows it.
• Encrypted connections. All traffic travels over HTTPS (TLS), from the browser to the server.
• Credentials kept out of code. Passwords and system keys live in the server's encrypted configuration, never in the repository.

What happens if something fails?

We follow the 3-2-1 rule: three copies, on two different media, one off the server. Off-site copies are encrypted. We test full restores and check that what comes back matches the original, because a backup that has never been restored isn't proven.

These are the numbers from our largest clinical system in production:

Figures measured on FUNCUAN's system. Each project sets its own recovery targets based on its operation, in writing.

For critical systems we also offer a standby server: a warm copy of the system on separate infrastructure, kept continuously up to date, that we bring into production if the main server fails. It is contracted as part of ongoing operations, depending on how much downtime your operation can tolerate.

What about artificial intelligence?

These are our rules:

• Commercial APIs only (Anthropic, Google, OpenAI), whose business terms exclude using your data to train their models. Never free consumer versions.
• Sensitive data only with your permission. Clinical records, financial data or personal information are not sent to an AI model unless the project requires it and you approve it in writing.
• A human decides. The AI assistants we build have explicit limits and hand the conversation to a person when a question falls outside their scope. In healthcare, that includes never diagnosing or prescribing.

Confidentiality and personal data protection

For healthcare, finance or critical-operations projects, we sign an NDA before accessing any information. We also formalize the processing of personal data under Colombia's Law 1581 of 2012: your company is the data controller and we act as the processor, with obligations and limits in writing.

If a security incident affects personal data, we notify you immediately, contain the problem, document what happened and support you in reporting it to Colombia's Superintendence of Industry and Commerce (SIC).

What you get when we sign

• An NDA and a personal data processing agreement.
• Architecture documentation: what runs, where, and how it connects.
• Administrative access to your infrastructure, your code and your data.
• A written backup plan with your system's recovery targets.
• A list of third-party providers that touch your data, and why.