Data security and compliance for AI training data
Your data is handled only by trained, vetted InitLabel team members in a controlled environment. We never use client data to train our own models and never sub-contract labeling to crowd platforms. You get accurate labels and a partner your security team can approve.
- NDA and DPA on every project
- No crowd workers
- Kenya Data Protection Act, 2019
Four promises we put in writing
These commitments apply to every engagement, so procurement and security know what to expect before a single file changes hands.
Your data never trains our models
We never use client data to train InitLabel’s own models or tools. Your datasets stay your competitive advantage.
No crowd platforms, ever
Every label is produced by InitLabel team members. We never sub-contract labeling to crowd or gig-work platforms.
Only the right people see it
Annotators see only the tasks assigned to them, never your full dataset, behind individual accounts with multi-factor authentication.
You hear from us fast
If an incident affecting your data is confirmed, you are notified within 24 hours, and regulators as Kenyan law requires.
Secure from first upload to final deletion
Scope and agree
We assess data sensitivity with you, sign your DPA and NDA, and agree where data is hosted and who can access it.
Transfer securely
Data moves over encrypted channels to approved storage. No email attachments, no personal drives.
Annotate under control
Work happens on managed devices or virtual desktops in approved tools, with access logging switched on.
Review and deliver
Reviewers work under the same access rules, and finished labels go back through the agreed secure route.
Return or delete
Source data is returned or deleted on the agreed schedule, and deletion is confirmed in writing.
Six layers of protection around your data
These are our baseline controls. Need something stricter? We tailor them and record the result in your SOW or DPA.
Facility security
Production work happens in our controlled Nairobi environment, not home offices or third-party venues, with access control, a clean-desk policy and backup power and connectivity.
Data protection
Encryption in transit (TLS 1.2+) and at rest, hosting in the region you choose, and export controls on secured projects.
Access control
Role-based, need-to-know access with individual accounts and MFA, regular access reviews and immediate revocation when work ends.
People
Background checks including a Certificate of Good Conduct, signed confidentiality agreements and data-privacy training at onboarding and refreshers.
Retention and deletion
Source data deleted on the schedule in your contract, with written confirmation. Backups are encrypted and expire on a fixed cycle.
Testing and incident response
A documented incident-response plan and a responsible-disclosure contact: hello@initlabel.com.
Sensitive and regulated data
Healthcare, finance, identity and personal data need more than good intentions.
Personal data
We process personal data in line with the Kenya Data Protection Act, 2019 and, where it applies, the GDPR. Faces and other identifiers can be redacted before annotation.
Health data
Health data projects run with a dedicated, named team, de-identified data where possible and contract terms agreed with your compliance team.
Financial and biometric data
Statements, ID documents, faces and voices are handled only in restricted workspaces under rules agreed in advance.
Start small, scale safely
Please don’t send personal, health, financial or biometric data until your DPA and handling approach are signed off. We can start with a de-identified sample.
A security review that moves at your pace
Bring your vendor-security, privacy and compliance requirements to us early. We respond to every request within two working days.
Request our security pack
Email hello@initlabel.com for our completed questionnaire and control descriptions.
Share your requirements
Send your questionnaire or control checklist and we’ll map every item to our controls, in plain language.
Sign the paperwork
We sign your DPA and NDA, plus an individual NDA for each person on the project if you need it.
Pilot with a safe sample
We prove quality and process on a small, low-sensitivity batch first.
Scale with confidence
Move to production with controls in place and a named contact for anything that comes up.
What security teams usually ask us
Will you use our data to train your own AI models?
Never. Client data is used only to deliver the work you’ve asked for. It is never used to train InitLabel’s own models or tools.
Who actually labels our data?
Trained, background-checked InitLabel team members working in our own controlled environment in Nairobi. We never sub-contract labeling to crowd or gig-work platforms.
Where is our data hosted?
In the region and platform you choose, including your own cloud. Data is encrypted in transit and at rest, and our teams access it through managed workspaces rather than copying it to personal devices.
Can annotators download, copy or screenshot our data?
Not on secured projects. We use managed devices or virtual desktops with export controls, and personal devices stay off the production floor. The exact controls are agreed in your DPA.
What happens to our data when the project ends?
Source data and working files are returned or deleted on the schedule in your contract, and we confirm deletion in writing.
How quickly will you tell us about a security incident?
We notify you without undue delay, and within 24 hours of confirming an incident affecting your data. We also meet the Kenya Data Protection Act’s 72-hour notification duty to the Office of the Data Protection Commissioner where it applies.
Are you ISO 27001 certified?
Our controls are designed to align with ISO/IEC 27001, and formal certification is on our roadmap. We’ll share our current security questionnaire and control descriptions so your team can assess us today.
Can our annotators sign our own NDA?
Yes. On top of the confidentiality agreement every team member signs, each person on your project can sign your own NDA.
Ready for accurate labels your security team will approve?
Tell us about your project, your data and the controls you need. We’ll send our security pack, answer your questionnaire and get you to kickoff without surprises.