01私たちの原則
01
デフォルトで読み取り専用
当社は御社のシステムから読み取るだけです。操作は御社のシステムで、御社の担当者が行います。
02
御社のデータ、御社のリージョン
データは御社が選んだ場所にとどまります。
03
御社のデータは御社のモデルだけを学習させます
あるクライアントのデータが、別のクライアントのモデルの学習に使われることはありません。
04
承認するのは人
AIが提言し、重要な判断は人が承認します。
05
すべてを記録
すべての閲覧、判断、エクスポートが記録されます。
02The data boundary
The intelligence moves. Your data stays.
This is the promise behind everything on this page: our platform runs inside your environment, reads your data without changing it, and keeps every result there.
- 御社の環境内で稼働Deployed in your own cloud tenant or on your own servers, in the region you choose.
- 読み取り専用コネクターWe read from your ERP and other systems. We never write to them or change a record.
- Nothing is copied outNo exports to our servers. Data, findings and evidence stay in your tenant.
- Your models stay yoursModels learn only from your data and stay with you. Nothing trains anyone else’s AI.
- Encrypted, logged, yours to controlEncrypted in transit and at rest. You grant access, you see every log, and you can switch it off.
03Privacy by design
Privacy and employee rights, designed in from day one
| 場所 | Requirement |
|---|---|
| European Union | GDPR; in Germany, works council co-determination on the technical monitoring of employees (the Works Constitution Act) |
| インド | The Digital Personal Data Protection Act, 2023, and its rules |
| EU AI法 | Systems that monitor or evaluate employees can be high-risk: documentation and human oversight |
How we design for it
- Employee data is pseudonymised until a finding needs a name
- Only the fields each test needs
- Read-only access, processed in your environment and region
- Every result explained; people decide
- Tests and models documented, versioned and auditable
04Audit the algorithms
Next, audit must test the algorithms themselves
Our own rules, models, LLMs and agents must meet the standards we apply to others: documented, validated and explainable.
| Reference | What it asks for |
|---|---|
| EU AI法 | Risk-based duties; for high-risk uses, including some employee monitoring, documentation and human oversight |
| IDW PS 861 | The German standard for auditing AI systems: governance, data, model, application and infrastructure |
| ISO/IEC 42001 | A management system for AI: policy, roles, risk assessment and lifecycle controls |
| IIA Standards | Internal audit’s own use of technology must be governed and its results reliable |
Not legal advice.
05トラストセンターの内容
- セキュリティ
- アーキテクチャ、導入形態、コントロール →
- 認証
- 有効な証明書のみ、それぞれ番号と日付付き
- プライバシー
- プライバシー通知、データ処理契約、再委託先の一覧
- 責任あるAI
- 説明可能な結果、人による承認、モデルのテストと監視、そして判断が人に影響する場合のバイアスチェック
- 継続性
- バックアップと復旧目標
- 脆弱性の報告
- 役割ベースのアドレス（例：security@ajalabs.ai）と、責任ある開示のポリシー