Role-based permissions
Every integration runs on credentials scoped to the least access the system allows. Nobody — not even a model — sees more than the task requires.
Before signing, you need to know where your data ends up.
We work with internal documentation, databases and customer conversations. These are the rules we apply to that information, and what changes for your company under Chile’s new personal data protection law.
The controls we apply
Not every project needs the same thing. These are the controls we put on the table and adjust to the sensitivity of the information and the sector.
Minimization before the model
When personal data is involved, the model only receives what it needs to reason: an internal identifier instead of the name and national ID. The table linking the two stays in your database.
The AI never writes on its own
Model output passes through a typed schema and validation before touching a CRM, an ERP or a database. Anything that doesn't fit goes to human review.
Traceable answers
In document assistants, the answer shows the source document and page. With no verifiable source, the assistant doesn't answer.
Activity logging
Executions and relevant access are logged, without storing sensitive information the process doesn't need.
Testing what fails
The test plan covers errors, exceptions and edge cases, not just the happy path. The evaluation suite runs before every change.
Providers and infrastructure
Your data doesn't train third-party models
We work on enterprise APIs from providers that don't use submitted content to train their models. That's a contract condition, not a preference.
Where the information lives
We prefer data to stay inside the client's environment: your Microsoft 365 tenant, your cloud, your database. When that isn't possible, we say so and weigh the alternatives with you.
Providers with current certifications
When choosing platforms we prioritize those holding valid ISO 27001 or SOC 2 Type II, and we state it in the proposal.
Turnkey if you prefer
If your IT team wants full control, we hand over the solution to run on your own infrastructure with your own credentials. In that setup we host and custody nothing of yours.
What changes for your company
Law 21.719 replaces Chile’s 1999 regime and applies to any organization processing personal data in the country, regardless of size. It is scheduled to take effect on 1 December 2026, with a bill in progress proposing a delay to December 2027.
- A Data Protection Agency with supervisory and sanctioning powers.
- Rights of access, rectification, erasure, objection and portability.
- Mandatory breach notification within tight deadlines.
- A record of processing activities with documented legal bases.
- A data protection officer when processing is significant.
- Fines up to 20,000 UTM, with warnings instead of fines for SMEs during the first year.
What we do about it
In every project we document which data is processed, for what purpose, where it is stored, how long it is kept and which providers are involved. That is exactly the input your legal team needs for the record of processing activities. The legal interpretation isn’t ours to make.
If you need to be ready for the law
We offer the data and compliance assessment as scoped work, inside the same assessment format: from 25 UF, in 1 to 2 weeks. It doesn’t replace your lawyer; it gives them the technical input they need.
- An inventory of where personal data lives: systems, spreadsheets, backups and providers.
- A review of access and inherited permissions nobody uses but that remain open.
- A map of what information leaves the company towards AI services, and under what terms.
- Prioritized technical recommendations: minimization, retention, logging and breach response.
- A document your legal team can use for the record of processing activities.
How we handle data on this site
Analytics only load if you accept cookies; without consent no event is sent. The form stores what you write so we can reply, and nothing else. The automation calculator runs in your browser: those figures never reach our server. The detail is in the privacy policy (in Spanish).
Frequently asked
Do you sign an NDA?
Yes. We sign an NDA before receiving client documentation and, when personal data is involved, a data processing agreement listing purpose, retention and sub-processors.
Can you work with sensitive data?
Yes, with safeguards defined case by case: minimization, pseudonymization, scoped permissions and providers chosen for the sensitivity involved. If a case requires that information never leaves your infrastructure, we design it that way from the start.
What happens if we end the engagement?
The data and records belong to your company and you can export them at any time. The contract defines migration support, retention periods and deletion at the end.
Is Law 21.719 already in force?
It is scheduled to take effect on 1 December 2026. In September 2026 the Chilean government submitted a bill to the Senate proposing a one-year delay, to December 2027 (Bulletin 18623-07). Until that bill passes, the operative date remains December 2026.
Are you legal advisors?
No. We implement technical controls and document how data is handled; the legal reading belongs to your lawyer or your data protection officer. We build around whatever that review defines.
Does your legal team need to review it?
Tell us the process, the systems involved and the outcome you need. We'll assess the scope and the next steps with you.