Demo page. This is a fictional company with sample data, shown to illustrate what a verified trust page looks like.

AI trust page

How Northwind Labs secures its AI features

Northwind Labs (demo)

Verified 02 Nov 2026

Northwind Labs uses large language models to draft support replies and summarise tickets inside our helpdesk product. Customer data is sent to model providers only for the request being processed and is never used to train models.

AI providers in use

OpenAI
Anthropic
Cloudflare AI Gateway

Verified controls

15 passing, 6 failing, 2 not applicable or unverifiable. Checked read-only against provider admin APIs; prompts and responses are never read.

OAI-001Organization audit logging is enabled.
OAI-0021 API key unused for 90+ days.
OAI-0031 API key older than 365 days.
OAI-004An organization spend limit is set.
OAI-0051 active project without a model allow-list.
OAI-0061 active project inherit the organization default retention.
OAI-007Owner count and invitations are within policy.
OAI-0081 API key owned by individual users.
OAI-009Rate limit settings not readable.
OAI-0103 models used in the last 30 days.
ANT-001No active keys in archived workspaces.
ANT-002All active keys are scoped to a non-default workspace.
ANT-003All active keys are younger than a year.
ANT-004Admin count and invitations are within policy.
ANT-005Workspace spend limits are not exposed by the Admin API for this organization.
ANT-0061 model used in the last 30 days.
AIG-001All gateways require authentication.
AIG-002No gateway stores prompts without DLP.
AIG-003All gateways have a rate limit.
AIG-004All gateways have a spend limit.
AIG-005All gateways with stored keys require provider credentials.
AIG-0061 gateway without guardrails.
AIG-0072 provider/model pairs used in the last 30 days.

Statements from Northwind Labs (demo)

Describe the AI/ML features in your product and their purpose.: Reply drafting and ticket summarisation in the helpdesk. Agents review every AI draft before it is sent.; Attested 2026-10-28
Is customer data used to train or fine-tune any model, by you or your providers?: No. We use the OpenAI and Anthropic APIs under their standard API terms, which exclude API data from training. We have not opted in to any data-sharing programme.; Attested 2026-10-28
What contractual terms (DPA, zero data retention) are in place with AI providers?: DPA signed with both providers. Zero data retention is enabled on the OpenAI production project.; Attested 2026-10-28
Where is AI data processed and stored (regions)?: Requests are routed through Cloudflare AI Gateway in the EU; provider processing occurs in the US. Our own storage is in the EU.; Attested 2026-10-28
Is there a human in the loop for AI outputs that affect customers?: Yes. A human agent approves every customer-facing message.; Attested 2026-10-28
List all subprocessors involved in AI features.: OpenAI, Anthropic, Cloudflare.; Attested 2026-10-28
Which AI governance frameworks do you align to (ISO 42001, NIST AI RMF)?: Aligned to NIST AI RMF; ISO 42001 certification planned for 2027.; Attested 2026-10-28