1. Security Philosophy
AI XVantage treats security as part of workflow design, not an afterthought. AI systems should be scoped, reviewable, access-aware, and shaped around meaningful human approval points.
2. Website Security
The public website is designed to collect only limited business enquiry information.
- Public forms should not request passwords, API keys, production data, or sensitive client records.
- Hosting and transport security should use HTTPS in production.
- Access to form submissions, once connected, should be restricted to authorised personnel.
- Website dependencies should be reviewed and updated as part of routine maintenance.
3. Data Minimisation
We aim to collect only the information needed to understand a business workflow, qualify an audit request, and decide the next step. Sensitive or regulated data should be shared only through approved secure channels after an engagement scope is agreed.
4. AI Workflow Safeguards
For AI workflow design and implementation, recommended safeguards include:
- clear workflow scope and ownership;
- least-privilege access to tools, files, APIs, and business systems;
- human approval checkpoints for significant or sensitive actions;
- reviewable outputs, logs, and escalation paths;
- testing for data leakage, hallucination, unsafe instructions, and adversarial prompts where relevant;
- documentation for users, operators, and decision owners;
- monitoring and improvement loops after deployment.
5. AI Governance Alignment
Our security posture is informed by the governance-forward AI environment in Singapore, including principles such as bounded use cases, human accountability, transparency, technical controls, and safe deployment practices. This does not mean AI XVantage is certified by, affiliated with, or endorsed by any government agency or AI assurance body.
6. Client Responsibilities
Visitors and clients should avoid sending confidential, personal, regulated, or sensitive data through the public website. During an engagement, clients remain responsible for confirming data ownership, access permissions, internal approvals, regulatory constraints, and business rules that apply to their workflows.
7. Third-Party Tools
AI workflow projects may involve third-party models, automation platforms, SaaS tools, cloud services, CRMs, email systems, or analytics tools. Each provider should be reviewed for data handling, access controls, availability, contractual terms, and security posture before production use.
8. Incident Response
If a security or data incident is suspected, the expected response is to assess the issue, contain risk, preserve relevant records, notify appropriate stakeholders where required, remediate the cause, and improve safeguards to reduce recurrence.
9. Vulnerability Reporting
To report a website security concern, contact security@aixvantage.ai.
10. No Absolute Guarantee
Security practices reduce risk, but no website, AI system, workflow, or service provider can guarantee complete security. Security decisions should be reviewed against the sensitivity of the workflow and the regulatory obligations of the organisation.