Skip to content
New: a sample workflow audit report
Scenox Studios
Book a call

Trust center: security, data and AI governance

How Scenox Studios handles data in the AI systems we build and run, written for security, legal and IT reviewers. It covers where data is stored in each deployment model, what model providers receive, which actions wait for a person, what the audit log records and how we handle incidents.

Send a security questionnaireEnterprise deployments

Trust summary

Last reviewed 15 October 2026

Training on your data
Never for other clients
Where systems run
Managed by Scenox, your cloud, on-premises or hybrid
Model access
Enterprise APIs, your cloud subscription or open models in your environment
Sensitive actions
Wait for a named approver on your team
Audit log
Every action, tool call and approval
Incidents
Workflow paused, cases routed to your team, written summary

Where your data lives

You choose one of four deployment models in the design stage. Each one sets where the system runs, where records are stored and how models are reached.

Where systems run, where data is stored, how models are called and who operates each deployment model
Deployment modelWhere it runsWhere data is storedModel callsWho operates it
Managed by ScenoxA dedicated Scenox environment. Nothing is shared with other clients.Inside that environment, in the cloud region agreed in the build plan.Provider enterprise APIs that do not train on API traffic, with zero data retention where offered.Scenox hosts and runs it. Your systems connect over scoped API credentials.
In your cloudYour AWS, Google Cloud or Azure account, in the region you choose.Your account, under your IAM, network rules and logging.Called through your own cloud subscription: Bedrock, Azure OpenAI or Vertex AI.Scenox operates it with the access you grant, and you can revoke it.
On-premisesYour data center, on your hardware.Your network.Custom small models and open models on your hardware. No calls leave your network.Agreed per engagement, by Scenox, your team or both.
HybridModels, retrieval index and audit log in your environment. Workflow engine and console managed by Scenox.Sensitive records, models and the audit log stay with you.Run inside your environment.Orchestration passes references between the two sides, not raw records.

Scroll sideways to see every column.

A bank that cannot send customer records outside its network would usually pick on-premises or hybrid. A 40-person agency with no infrastructure team would usually start managed. For tasks that must stay inside your environment, see private AI models.

  • No training for other clients

    Your data is never used to train models for other clients. A custom model trained on your records belongs to your deployment.

  • Retention set per workflow

    Documents, transcripts and logs are kept for the period your policy sets. Audit logs usually outlive the documents they refer to, and both can sit in your own account.

  • Redaction before the model

    Personal data is removed from a step's input before it reaches a model wherever the task allows it.

  • Encryption

    Data is encrypted in transit and at rest.

  • Deletion in the contract

    Access, retention and deletion terms for client data are written into the agreement with each client.

Model providers and what they receive

Most steps in a workflow are ordinary code. A model sees data only at the one or two steps that need reading, classifying or drafting.

How we split code and models
How Scenox systems reach models, with examples and when each route is used
RouteExamplesWhen we use it
Provider enterprise APIsOpenAI, Anthropic, Google GeminiManaged deployments. Endpoints that do not train on API traffic, with zero data retention where the provider offers it.
Your cloud subscriptionAzure OpenAI, AWS Bedrock, Google Vertex AIWhen model use must be billed, logged and governed inside your own cloud account.
Open and custom models in your environmentLlama, Mistral, Qwen and small models fine-tuned on your dataOn-premises and hybrid setups, and narrow high-volume tasks where data should not leave your network.

Scroll sideways to see every column.

Sent to the model

  • The input one step needs, such as the text of a single invoice for extraction
  • For an answer, the question plus the passages retrieved for it
  • The instructions for that step and the output format it must return

Kept out of the model

  • Data the step does not need. Personal data is redacted first where possible
  • Content the user may not open. Source permissions are applied at retrieval time
  • System credentials. Tools are called by the workflow engine with scoped service accounts

Every provider and model is named in the architecture document you review, and we swap a model only after the evaluation suite passes on your cases. Nox, the assistant on this website, runs on Microsoft Azure AI Foundry, and its messages are not used to train models.

Approvals and audit logs

Sensitive actions wait for a named person

Approval points are set in the design stage and enforced in workflow code. The model can propose an action. It cannot skip the gate.

  1. Step 1Agent

    Propose

    Action agent

    Prepares the action, such as a refund above the approval threshold, with the evidence behind it.

  2. Step 2Agent

    Check

    Workflow engine

    Applies your limits and policy rules in code, outside the model.

  3. Step 3Human

    Approve

    Your team

    A named person on your team approves, edits or rejects it in the operator console.

  4. Step 4Agent

    Execute and log

    Workflow engine

    Carries out the approved action and records who approved it and when.

What waits for approval

You choose the gates. These are the ones most teams keep. Before a system acts on its own at all, it runs in shadow mode next to your team until it meets the thresholds agreed in the build plan.

  • Payments and refunds
  • Outbound messages to customers and suppliers
  • Any action above a threshold you set
  • Fields or decisions the system is unsure about
How pilots and shadow running work

What each audit log entry records

Inputs
What the step received
Outputs
What it returned or changed
Tool calls
Each system it touched and what came back
Model and prompt version
Recorded with every action
Approver
Who approved, edited or rejected, with a note
Guardrail stops
Where a limit halted the agent and handed over to a person
Timing and cost
Duration of each run and cost per task

Logs can be stored in your own account, alongside your other records.

Access control

Every agent runs with the narrowest access that lets it finish its task. A support agent that issues refunds can call the refund endpoint up to its limit and nothing else.

  • Least-privilege agents

    Each agent gets only the permissions its task needs, through scoped service accounts with per-action limits.

  • Your identity provider

    Sign-in to the operator console goes through your identity provider, so your joiner and leaver process applies.

  • Permission-aware retrieval

    Knowledge assistants apply the access rules of your source systems, so people only get answers from content they can already open.

  • Sandbox first

    Builds start against a sandbox of your tools where one exists, before any production access.

  • Untrusted input

    Inbound email, documents and web content are treated as untrusted, which limits what a prompt injection can reach.

  • Rules outside the model

    Limits, thresholds and approval points are enforced in workflow code that the model cannot change.

Incidents and support

When a system misbehaves, the safe default is to hand work back to people. Here is the sequence we follow on every system we run.

  1. 1

    Detect

    Monitoring and drift alerts notify us and your named contact. Failed steps retry, then alert the owner with the error and the data involved.

  2. 2

    Contain

    We can pause a workflow so new cases go to your team while the system is checked.

  3. 3

    Fix and re-test

    The fix is re-tested against the evaluation set of your past cases before the workflow acts on its own again.

  4. 4

    Report

    You receive a written incident summary: what happened, which cases were affected and what changed.

Ongoing support in managed operations

  • Accuracy measured in production, with alerts when it drifts
  • A weekly sample of cases reviewed by a person
  • A monthly report against the metrics agreed before launch
  • Documentation and runbooks for what to do when something breaks

Report a concern

To report a security or privacy concern about this website or a system we run, email compliance@scenoxstudios.com.

Subprocessors

The providers that process data for this website. For a client system, the list depends on the deployment model and model providers chosen, and it comes with the data processing agreement.

Read the privacy policy
Subprocessors used by scenoxstudios.com, their purpose and the data they process
ProviderPurposeData processed
FormspreeProcesses contact form submissions and forwards them to our inboxName, work email, company and message you send
Microsoft Azure AI FoundryGenerates replies for Nox, the assistant on this websiteMessages typed into the chat
Website hosting providerServes scenoxstudios.comStandard server logs such as IP address, browser and pages requested

Scroll sideways to see every column.

Regional regulations

Short, neutral summaries of the laws buyers ask us about most, each linked to the official source. We design systems to support your obligations under them. Whether a specific system meets them is for you and your counsel to decide, and we supply the documents they need.

United Kingdom

UK GDPR and the Data Protection Act 2018

The UK GDPR sets the rules for processing personal data in the UK and is read alongside the Data Protection Act 2018. Article 5 lists seven principles, including data minimization, storage limitation, security and accountability. The Information Commissioner's Office (ICO) regulates it.

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and changed parts of UK data protection law.

How we design for it

Each step receives only the data it needs, retention is set per workflow, and the audit log shows who did what. Systems can run in the UK cloud region you choose.

Official sources

European Union

EU AI Act (Regulation (EU) 2024/1689)

The Act sorts AI systems by risk. A short list of practices is banned. High-risk systems carry duties such as risk management, logging, documentation and human oversight. Some systems carry transparency duties, such as telling people they are talking to a machine. Most other uses have no specific rules.

It entered into force on 1 August 2024. Prohibitions applied from 2 February 2025 and rules for general-purpose AI models from 2 August 2025, and most remaining rules from 2 August 2026. A 2026 amendment moved the high-risk deadlines to 2 December 2027 for Annex III uses such as employment, and to 2 August 2028 for AI built into regulated products.

How we design for it

Our systems log every action and keep a person on the decisions you choose, and voice and chat agents can say up front that they are AI. We flag workflows that touch hiring or other Annex III areas during the audit. How a given use case is classified is for you and your counsel to confirm.

Official sources

United Arab Emirates

UAE PDPL, DIFC and ADGM

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) came into force on 2 January 2022 and is overseen by the UAE Data Office. Companies in free zones that have their own data protection legislation fall outside its scope.

In the Dubai International Financial Centre, the Data Protection Law (DIFC Law No. 5 of 2020) applies, supervised and enforced by the DIFC Commissioner of Data Protection.

In Abu Dhabi Global Market, the ADGM Data Protection Regulations 2021 apply, enacted on 11 February 2021 and overseen by an independent Office of Data Protection.

How we design for it

We confirm early whether your entity is onshore, in DIFC or in ADGM, because the applicable law differs. Systems can run in your cloud account in an in-country region your provider offers, or on your own servers.

Official sources

Saudi Arabia

Saudi Personal Data Protection Law (PDPL)

The PDPL was issued by Royal Decree M/19 and later amended. It came into force on 14 September 2023, followed by a one-year grace period for compliance. The Saudi Data and AI Authority (SDAIA) is the competent authority.

It covers processing that takes place in the Kingdom, and processing of data about people residing in the Kingdom by parties outside it.

How we design for it

Where data has to stay in the Kingdom, we deploy into your cloud account in an in-Kingdom region your provider offers, or on your own servers, with open or custom models running inside the same boundary.

Official sources

India

Digital Personal Data Protection Act, 2023

Parliament enacted the DPDP Act on 11 August 2023. The DPDP Rules, 2025, notified on 14 November 2025, give it full effect and allow eighteen months for phased compliance.

The framework rests on principles that include consent and transparency, purpose limitation, data minimization, storage limitation and security safeguards. It creates the Data Protection Board of India to oversee compliance and inquire into breaches.

How we design for it

Each step gets only the data its purpose needs and retention follows your policy. Consent and notice records can be kept as evidence in the audit log, and systems can run in an Indian cloud region in your account.

Official sources

General information, checked against the linked sources on 15 October 2026. It is not legal advice. If a workflow touches hiring or employee decisions, read about our HR operations work, where these questions come up most.

What we provide for your security review

The documents your security, legal and IT teams get during evaluation and procurement, prepared by the engineers who will build the system.

  • Security questionnaire

    Your questionnaire or a standard one such as SIG Lite or CAIQ, completed by the engineers who will build the system.

  • Architecture and data flow

    A diagram of your deployment: where data enters, which models see it, where it is stored and for how long.

  • Model provider terms

    The providers and models used for each step, with their data handling terms.

  • Contracts

    A data processing agreement, the subprocessor list for your system and your standard vendor terms, reviewed during procurement.

  • Evaluation results

    Accuracy on your past cases, measured per field or decision against thresholds agreed before launch.

  • Runbooks

    How the system works, how to change it and what to do when something breaks.

Send us your security questionnaire

Send it with a short note on the workflow in scope. We reply with the completed questionnaire and a draft data-flow diagram.

Send a security questionnaire

Security and data questions

Is our data used to train AI models?

No. Your data is never used to train models for other clients, and we use model provider endpoints that do not train on API traffic. Custom models trained on your data belong to your deployment.

Where is our data stored?

It depends on the deployment model. In a managed deployment it sits in a dedicated Scenox environment that is not shared with other clients. In your cloud or on-premises it stays in your account or data center. In a hybrid setup, sensitive records, models and the audit log stay with you.

What do model providers receive?

Only the input a step needs, such as the text of one invoice or a question with its retrieved passages. Personal data is redacted first where possible. We use enterprise endpoints that do not train on API traffic, with zero data retention where the provider offers it. On-premises deployments make no external model calls.

Which actions need human approval?

You decide during design. Payments, refunds and outbound messages usually wait for a named person, along with anything above a threshold you set. The approver, the decision and the time go into the audit log.

How long are logs and documents kept?

Retention is set per workflow to match your policy. Audit logs are usually kept longer than the documents and transcripts they refer to, and both can be stored in your own account.

What happens if something goes wrong in production?

Monitoring alerts us and your named contact. We can pause a workflow so cases go to your team, then fix, re-test against the evaluation set and send a written incident summary.

Will our system meet UK GDPR, EU AI Act or PDPL requirements?

We design systems to support your obligations under these laws, with data minimization, retention per workflow, in-region deployment, human oversight and full logging. Whether a specific use case meets them is assessed by you and your counsel, and we supply the architecture and data-flow documents they need.

Can you complete our security questionnaire?

Yes. Send your own questionnaire or a standard one such as SIG Lite or CAIQ, and the engineers who will build the system complete it. We include the architecture and data-flow diagram and the model provider terms.

Bring your security team to the first call.

We walk through the architecture, data flow and controls for your workflow, and answer your questionnaire in writing.

Book a strategy callor email hello@scenoxstudios.com

What happens next

  1. 1

    Architecture call

    Your environment, data sources, identity provider and the workflow in scope, with an engineer.

  2. 2

    Security review

    Questionnaire, data-flow diagram and model provider terms for your security, legal and IT teams.

  3. 3

    Audit and proposal

    A workflow audit inside your constraints, then a written scope, deployment plan and fixed price.