Data protection
Controls verified in the current implementation
Separation and isolation
Identity, private Drive, indexing, organization, ONIXBRAIN, and export are separate purposes. Data plane queries require the authenticated user plus product and ownership filters. Service credentials remain on the server.
Files and versions
An upload completes only after physical version confirmation. The current version is revalidated before indexing, organization, and local publication in ONIXBRAIN. Individual exclusions are checked again before publication. Transfer URLs are temporary and are excluded from public responses.
Conditional AI and OCR
AI and OCR transports have separate controls and can be off. A capability present in code does not prove that it is active in an environment. ONIXBRAIN does not expand the scope of the private Index.
Minimal diagnostics
Diagnostic logs use allowlisted codes, counters, and technical pseudonyms. File names, content, queries, URLs, headers, and credentials are excluded from these fixtures. Hashes remain pseudonymized data.
Pending information
Regions, retention periods, legal bases, subprocessing contracts, and legal responsibilities require responsible confirmation. This local revision does not present those fields as operational facts.