Human oversight
Important decisions remain the responsibility of a person designated by the client.
Studio Nico Trust Center
Trust starts before deployment.
Clear practices for data, access, providers and human oversight throughout an AI project.
Ask a questionControls matched to real risk.
Every engagement starts with scope, authorized data, necessary access and expected validation.
Least privilege
An agent receives only the access and actions required for its use case.
Minimum data
Sensitive data stays out until its use, retention and protection are approved.
Traceability
Key decisions, limits, providers and responsibilities are documented for the engagement.
What the website collects.
Public collection is limited to information voluntarily submitted through forms.
Name, email, organization, request type and message when you request a meeting.
Email address supplied to receive the Canada AI newsletter and related notifications.
Answers and contact information submitted when you choose to receive or discuss the results.
Important boundary
Do not send secrets, passwords, client files, health data or financial information through public forms.
Public website providers.
This list describes services observable in the current website, without assuming which tools a future client engagement will use.
Netlify
Website hosting, public forms and functions used for notifications.
Resend
Delivery of notifications and email operations related to the newsletter.
AI providers
Provider, region, retention and data use are assessed and documented before every client integration.
Public documentation.
Practical resources to understand the Studio Nico approach before a project discussion.
Security
Protect data before accelerating
Read the guide
Governance
Govern AI use in a small business
Read the guide
Method
From assessment to operational adoption
View the method
Assessment
AI maturity assessment
Start
Studio Nico does not currently claim SOC 2 or ISO 27001 certification. Compliance requirements are confirmed in writing based on the engagement and selected providers.
Frequently asked questions.
Is client data used to train a model?
Not without an explicit decision. The provider, account type, retention settings and terms must be validated before client data is processed.
Can Canadian hosting be required?
This requirement can be included, but it must be confirmed across the full chain: application, models, storage, logs, telemetry and support.
How is access managed?
Access is limited to the engagement need. Shared accounts are avoided and permissions must be removable when the work ends.
What happens if an incident is suspected?
The affected processing should stop, relevant access should be revoked, facts should be preserved and the client should be notified so its incident process can begin.
A specific requirement?
Let us discuss your data, sector and required controls before selecting a solution.