Security and consent
A standard you can check.
Your data stays where it is until you sign. Here is what we never ask for. Here is what stays out. And here is how we treat data if it ever moves. Hand it to your security lead or your lawyer. They can check it line by line.
What we never ask for.
If anyone asks you for these before a signed deal, stop.
A fee
There is no fee before anything is signed. Companies pay nothing to be introduced.
Files or samples
We fill in the Data Inventory by talking with you. No data moves to do it.
Logins or passwords
Not at any stage. Your own admin runs any export.
OAuth or connector access
We never ask you to add an app to your tools. We never ask you to link a tool to your workspace.
A choice by a deadline
We set none. You take the time you need.
The standard.
Eight rules. We keep every one, on every job.
Nothing moves first
The first step never needs a file, a login or an export.
Consent before each introduction
Someone who can sign for your firm says yes in writing. That yes names the buyer.
Our pay, in writing
Before any introduction, we tell you in writing who pays us and how.
One buyer at a time
We don’t shop your firm to a group of buyers at once.
One path per firm
We make an introduction or we prep your data. We never do both.
What stays out comes first
We agree on what stays out before any export exists. That means our default list, plus your own.
Built-in exports only
After you sign, your own admin runs the export. They use the tool’s own export. Nothing gets put in your workspace. The signed deal sets how the files get to us.
Your lawyer in the loop
Your lawyer sees any rights, terms or privacy flag before anything moves. We don’t give legal advice. We are not the buyer. We are not an agent of any AI lab.
What stays out by default.
These come out before anything else. You can add to this list. We never take from it.
- People
- HR and staff files. Direct messages. Notes on job candidates and hiring.
- Regulated
- Health data, card data and data about kids.
- Third parties
- Records your clients hold. Channels you share with clients, like Slack Connect. Anything under an NDA or a data processing agreement. Your lawyer can clear these. Until then, they stay out.
- Secrets
- Passwords, API keys, tokens and the strings that link to your systems.
- Flagged
- Personal data from the EU and UK. Call and meeting recordings. The terms of your tools, and the privacy promises you have made. All of these go to your lawyer to review.
If we prep the data.
We only do this under a separate, signed prep deal. When we just make an introduction, we never touch your data.
- 01
Export
After you sign, your admin makes copies. They use the tool’s own export.
- 02
Take out
First we pull what stays out. That means whole systems, channels, date ranges and types of data.
- 03
Scan for secrets
We hunt for passwords, keys and tokens. Then we strip them out.
- 04
Swap out names
Each person and firm gets the same stand-in each time. The links between them stay. The names go. The key that maps stand-ins to real names never goes into a package.
- 05
Check by hand
We read samples by hand. You sign off on a sample before anything is final.
- 06
Write it up
Each time, you get a list of what is in the package. You also get a guide to each field, a record of where the data came from, and checksums.
The limits, said plainly.
No process takes away every risk. Taking out names does not take out every secret. On a small team, people can be known from the context. That is why you decide what is in. You can always leave a whole type of data out.
Once a model learns from data, you can’t really pull it back out. The buyer runs its own checks and its own security review. Its written terms say what happens to the data. Ask the buyer for its security papers.
If you are worried about how we handle anything, write to hello@steamwirelabs.com.
Start with a talk.
A short call. No fee, no files and no logins before anything is signed.