Skip to content
Get a straight answer on AI

Security: how we handle your data. Your data stays yours.

We deploy and operate directly within your existing security perimeter, implementing NIST AI RMF and SOC 2-aligned controls. We integrate and operate the AI systems we build. Network security, IAM and endpoint security remain the exclusive responsibility of your team or your MSSP. An MSSP is a managed security service provider.

Get a straight answer on AIBook 15 minutes with Connor

Ask Roo: How would you get into our systems?

How we handle your data.

Agent controls

  • On every AI system we build, we run the approval gates, scoped access, logging, testing, and cost caps.
  • Agents run on scoped credentials you can revoke, and every action they take is logged where your team can read it.
  • Integrations stay read-only until the rulebook, the rules your team approves in writing, allows a write.
  • If your procurement has requirements a vendor must meet, bring them to the 15-minute call, and we will go through them with you there.

Data handling

  • Your data stays in your systems wherever the work allows. We build on the tools you already run and connect to them with scoped credentials.
  • At handoff you get every credential, repository, and dataset, and we delete our copies on request.

What we never do with your data

  • We never train models on your data.
  • We never move your data into a tool you have not approved.
  • We never share it with another client, a venture, or a partner.
  • We never keep access after an engagement ends.
  • We never let an agent act outside rules your team approved in writing. What runs on its own and what waits for a person is set with you, and the log shows the person or rule that approved each action.

How access works

  • We ask your team for access and ask again before it widens.
  • Named people only, granted per engagement and removed when the person or the engagement ends. No shared logins.
  • Least privilege. A person gets the access the task needs, and the task is written down.
  • Production changes go through review, and every deploy is logged.

Questions and reports

  • Email support@webaroo.us. A person answers, not a ticket queue.
  • If you find a vulnerability in something we built or run, email the same address with Security in the subject line.

What owners ask before the first call.

We deploy and operate directly within your existing security perimeter, implementing NIST AI RMF and SOC 2-aligned controls. Every agent runs on scoped credentials you can revoke, and every action it takes is logged where your team can read it. Integrations stay read-only until the rulebook, the rules your team approves in writing, allows a write. If your procurement process has its own requirements, bring them to the 15-minute call, and we will go through them with you there.

Questions to ask before you hire an AI firm

No. We never train any model on your data.

You receive every credential, repository, and dataset we hold for you, our access is removed, and we delete our copies on request.

Named Webaroo people on your engagement, each with their own login and only the access the task needs. Your team grants that access and can cut off our access in one step. Network security, IAM and endpoint security remain the exclusive responsibility of your team or your MSSP. An MSSP is a managed security service provider.

Meet the team

Bring us your security questions. A straight answer first.

The first paid step is your AI strategy, a 10-day AI readiness assessment: AI inventory, risk tiers, the top 3 workflows with today's numbers and a 90-day plan.

Get a straight answer on AIBook 15 minutes with Connor