Skip to content
Iotron AI

Policy

How Iotron uses AI tools in delivery and on this website, and how data is protected in the process. Effective and last updated: 7 November 2026.

1. Purpose

Iotron uses AI tools to work faster and better, and builds AI into what we deliver. This policy explains the rules that protect client data, quality and accountability in both cases.

2. Principles

  1. People are accountable. AI proposes; named engineers review, test and take responsibility for every deliverable.
  2. Confidentiality first. Client data is protected regardless of the tool used.
  3. Transparency. Clients know how we intend to use AI on their project and can opt out.
  4. Quality. AI output is treated as unverified until checked.
  5. Lawful and fair. We respect intellectual-property, licensing and data-protection law, and we test AI systems for bias and safety where decisions affect people.

3. Approved tools

We use only tools approved after review of their data-handling terms: enterprise-tier AI assistants and coding tools whose contracts state that our inputs are not used to train models; self-hosted or private-environment models for sensitive work; and internal tools we build. Not permitted: personal or free consumer AI accounts for client or Iotron confidential work; tools whose terms allow training on our inputs; unapproved browser plug-ins or agents that read our screens or repositories.

4. Data classes and what may be entered

Public — Marketing content, published documentation

May be used with approved tools

Internal — Iotron internal notes, non-sensitive code

Approved tools only

Client confidential — Client source code, designs, contracts, non-public data

Only with approved tools and the client's agreement in the contract or kickoff; otherwise not entered

Restricted — Personal data, credentials, secrets, health/financial records, production data

Never entered into external AI tools; use anonymised/synthetic data or a private self-hosted environment with written client approval

5. Engineering practices

AI-generated code, tests, configuration and documents are reviewed by an engineer before merge or delivery, and pass the same automated tests and security scans as human-written work. Secrets, keys and credentials are never placed in prompts. AI must not make final decisions about people or approve production changes.

6. Client transparency and choice

At kickoff, we state which AI tool categories we intend to use and confirm the client's data rules. Clients may opt out of AI-assisted delivery, wholly or for specific data or work packages. Client data is not used to train AI models without the client's written agreement.

7. AI we build for clients

Before release, AI systems have a documented purpose and limits, an evaluation set and pass criteria, bias/robustness/safety checks proportionate to risk, logging and monitoring, human-override paths and a rollback plan.

8. IONA, our website assistant

IONA answers visitors' questions about Iotron using a third-party AI model, chosen under the same review as the tools in section 3. It is instructed to answer only from information Iotron has approved for publication, to stay on Iotron topics and to point visitors to our team when it does not know. It cannot make commitments on Iotron's behalf, and it cannot book, move or cancel a meeting by itself: a booking happens only when the visitor confirms it. Messages are sent to the model provider to generate replies and are not stored by Iotron (see our Privacy Policy). AI replies can be wrong, so visitors should confirm anything important with our team and should not share personal or confidential details in the chat.

9–12. Records, incidents, training and regulation

We keep project-level records of AI tool categories used; suspected data-exposure incidents are reported and contained immediately; all staff complete AI-use training on joining and annually; and we monitor evolving AI and data-protection rules in the regions where we operate.