This policy applies to all data that Ionio holds or processes, including data belonging to clients, prospects, employees, contractors and website visitors. It covers every environment we use to do the work: laptops and endpoints, cloud infrastructure, code repositories, collaboration tools, and the AI platforms and APIs used in delivery.

It complements our Privacy Policy, which describes how we handle personal information as a controller, and our Terms and Conditions. Where a client's own data processing agreement or security schedule imposes stricter requirements, those requirements apply to that engagement.

Ionio acts as a controller for data it collects for its own purposes, such as website analytics, sales enquiries, marketing contacts and employment records.

Ionio acts as a processor for data belonging to a client that we handle to deliver the Services. In that role we process only on documented instructions from the client, do not use the data for our own purposes, and return or delete it at the end of the engagement. Where required, we enter into a data processing agreement recording these obligations, the categories of data, the purposes of processing and the approved subprocessors.

Every dataset we handle is classified, and the classification determines where it may be stored, who may access it, and how long it is kept.

Because we build AI systems, this section matters more than any other. Our standing commitments are:

We use a limited set of third-party providers to deliver our services. Categories include cloud infrastructure and hosting, source control and CI, AI model and API providers, observability and error tracking, communication and collaboration, project management, and payment and accounting.

Data is kept only as long as it is needed. Default schedules, unless the engagement agreement sets different terms:

Deletion covers primary storage, derived artefacts such as embeddings and caches, and copies held with subprocessors where we control them. Written confirmation of deletion is provided on request. Data held under a legal hold is retained until the hold is lifted.

Our team and our providers operate across multiple countries, including India, the United States, the United Kingdom and the European Union. Where personal data leaves the European Economic Area or the United Kingdom, we rely on an adequacy decision or on Standard Contractual Clauses with supplementary measures. Where a client requires processing to remain in a specific jurisdiction, that constraint is agreed before work begins and configured into the infrastructure and the choice of providers.

We maintain an incident response process covering detection, containment, assessment, notification, remediation and post-incident review.

Where we hold personal data as a controller, individuals can exercise their rights as described in our Privacy Policy.

Where we hold personal data as a processor, requests from individuals are referred to the client without undue delay, and we assist the client in responding, including by locating, extracting, correcting or deleting the relevant records. We do not respond to such requests directly unless the client instructs us to.

Clients can request an export of their data in a standard machine-readable format at any point during an engagement and for 30 days after it closes.

Systems we operate are backed up on a schedule appropriate to the workload, with backups encrypted and access-controlled to the same standard as primary storage. Restore procedures are documented and tested. Where a client's own environment hosts the system, backup and continuity remain under the client's control and their policies apply, with our recommendations documented at handover.

We respond to client security questionnaires and due diligence reviews as part of onboarding. Clients with a contractual right to audit may request evidence of the controls described in this policy once per year, on reasonable written notice, at a mutually agreed time and scope, and subject to confidentiality. Where a control is delivered by a subprocessor, we provide that provider's certifications or reports where they are available to us.

This policy is owned by Ionio's leadership and reviewed at least annually, and additionally whenever we adopt a materially different tool, provider or delivery model, or when applicable law changes. Revisions are published on this page with an updated effective date. Where a change materially affects an active engagement, the affected client is informed directly.

For questions about this policy, a data processing agreement, a security review, or a deletion or export request, contact us using the details below or through the contact form on our website.