Security built into how we work
Protecting client systems and data is part of every PrimeAI Analytics project. This page sets out the controls we apply, the frameworks we follow, and what we do if something goes wrong.
Last updated September 2026
The Pillars of PrimeAI Analytics' Security Promise
Governance by Design
Security is part of how we plan and deliver every project. Written policies, internal reviews, and clear ownership keep each engagement accountable from kickoff to handover.
Data Integrity and IP Protection
Your data and your models stay yours. Access is tightly controlled, data is encrypted, and every project runs under signed confidentiality terms. We never reuse what we build or store for anyone else without your written consent.
Compliance Without Compromise
Our work is guided by ISO/IEC 27001, the NIST Cybersecurity Framework, the Lesotho Data Protection Act, and GDPR principles. These standards shape our daily practice, not just our paperwork.
Continuous Assurance and Transparency
Security doesn't stop at delivery. We keep reviewing, monitoring, and assessing risk after launch, and you can ask for evidence and documentation whenever you need it.
How we protect your systems and data
Six areas of control, applied together so no single failure puts your data at risk.
Data protection
Client data is encrypted wherever it lives or travels.
- Encryption in transit (TLS) and at rest
- Encryption keys managed and rotated
- Sensitive fields masked in test and development
Identity & access
Only the right people get in, and only to what they need.
- Multi-factor authentication for all staff
- Role-based, least-privilege access
- Access reviewed regularly and removed on exit
Infrastructure
Systems are hardened, separated, and watched.
- Separate environments for each client
- Patching and vulnerability scanning
- Central logging and alerting
Secure development
Security is part of how we build, not a final check.
- Peer code review before release
- Dependency and secrets scanning
- Testing before anything reaches production
People & process
Our team is trained and bound by clear rules.
- Confidentiality agreements for staff and partners
- Security awareness training
- Clear policies for devices and remote work
AI system security
Models and their data pipelines are protected like any other system.
- Training data access controlled and logged
- Model versions tracked and documented
- Checks for misuse and unexpected outputs
Frameworks we follow
We measure our controls against recognised standards. The status shows where we stand with each one today.
- Practices aligned
ISO/IEC 27001
Information security management
- Practices aligned
NIST Cybersecurity Framework
Identify, protect, detect, respond, recover
- Compliant
Lesotho Data Protection Act
Personal data handling
- Principles followed
GDPR
Personal data of EU residents
- Practices aligned
CSA STAR / ISO 27017
Cloud security
If something goes wrong
No system is risk-free. What matters is how quickly we find a problem, how honestly we tell you, and what we change afterwards.
We spot the issue through monitoring or a report, then isolate affected systems to stop it spreading.
We work out what happened, which data and clients are affected, and how serious it is.
Affected clients are told promptly, and regulators where the law requires it, with clear facts and next steps.
We remove the cause, restore normal service, and confirm data is safe.
We document what went wrong and change our controls so it does not happen again.
Found a security issue?
Tell us at the address below. Include what you found and how to reproduce it, and please give us reasonable time to fix it before sharing it publicly. We will acknowledge your report and keep you updated.