Windmill

United States

The following types of data must be retained for the periods noted, to effectively support Windmill's services and compliance requirements: Account management: Supporting customers’ needs by maintaining a history of dealings with them. This includes the history of interactions, contact details, agreements, services information and key conversation records. This data is retained Until deletion is requested. Service information: Confidential information is shared during the course of providing Windmill’s services. This may include proprietary documentation and confidential data of customers' business activities. This is data retained Until deletion is requested. Employment records: Maintaining compliance as an employer of the Windmill team requires retaining records of key human resources activities for 7 years. Requests for information or deletion by Windmill employees will consider and attempt to remove sensitive private information that does not directly impact compliance with required human resources legislation. Any data that cannot be deleted when requested will be communicated to the employee with the associated reasons why. This data is retained Until deletion is requested. Multiple systems are in place to support debugging of issues and to improve the products and services. All data is anonymized where possible to reduce the sensitivity of the information. This data is retained until deletion is requested. Private data: Personally identifiable data is collected, processed and stored for users of Windmill’s services. This is subject to those users' privacy rights, including the right to access, modify and delete that information where it does not conflict with Windmill’s legitimate needs and regulatory compliance requirements. Where data requests cannot be fulfilled this is communicated with the reason(s) why. This data is retained Until deletion is requested.

When system assets, devices and any hard copy documents are disposed of, the information security practices that otherwise apply, are removed. It is important to ensure all sensitive data is completely and effectively erased, destroyed or left unreadable prior to the removal of these security protections.

Data handling is a broad practice that is critically important to protecting the security, confidentiality, integrity and availability of data used by Windmill and its customers. The following practices are required to be applied to ensure effective data handling: -The security and confidentiality of all data is protected by default, unless known or approved otherwise. -All sensitive data is restricted to approved and secure storage locations. -Key information and documents are backed up regularly to separate and secure locations to ensure recoverability in the event of an adverse event, third-party vendor failure or other issue.

Cloud hosted

TimescaleDB

yes

yes

We use OpenAI models (specifically GPT-4o-mini, GPT-3.5-turbo, and GPT-4-turbo) and Claude (Sonnet 3.5).

Our LLMs are configured to not retain customer data beyond the duration of the API request.

Our LLM operates in a secure, multi-tenant environment managed by the respective LLM providers (e.g., OpenAI and Anthropic). Each provider adheres to stringent data isolation and security protocols to ensure customer data is not accessible across tenants.

Our LLMs operate in compliance with the data residency requirements of the LLM providers we use (OpenAI and Anthropic).

We have a copy of our draft report for SOC 2 Type 1 compliance. When we get requests for data deletion, we act on them within reason. Clients always have the option to delete their own accounts. We are in the process of a Soc 2 Type 2 audit now.

yes

2024-11-09

yes

Google SSO

no

no

support@gowindmill.com

no

no

no

no