Privacy policy.
Effective date: the date of first publication of this page
Last updated: 2026-09-15
Who We Are
Boundary Stabilization Authority, LLC ("BSA", "we", "us", "our") operates the Safe for Humanity Platform, a governance certification service for artificial intelligence systems. Our address is 6265 Greenwich Dr. #210 San Diego, CA 92122, United States. For privacy questions, contact privacy@safeforhumanity.com.
This policy explains, in plain language, what information we collect, how we use it, who we share it with, and the choices you have. If you are a healthcare organization, our Business Associate Agreement adds PHI-specific terms. If you are in the EU or UK, our Data Processing Agreement adds GDPR-specific terms.
What We Collect
Account information. When you create an account or are invited as a Governance Officer: your name, email address, job title, organization, phone number, and authentication credentials. We use these to provide access, send governance notifications, and meet regulatory requirements.
Governance monitoring data. When your organization registers AI systems: governance events (performance metrics, threshold events, configuration states), governance scores, Safe Terminal State activations and recoveries, parameter change history, and audit trail events, stored in the Governance Audit Store with 10-year minimum retention. The Platform is designed to observe governance metadata, not the content of AI decisions or patient/customer records.
Usage data. Login timestamps and IP addresses, feature usage, API access logs, and error reports,used for security, troubleshooting, and improvement.
Communications. Support requests and responses to governance notifications, retained for support quality and compliance.
How We Use Information
We use your information to: provide the Platform's governance monitoring and certification services; manage Governance Officer accounts and send governance alerts; maintain security and prevent fraud; comply with legal obligations (HIPAA, GDPR, SOC 2, and lawful regulatory requests); improve the Platform using aggregate, anonymized data only; and send service, update, and security communications. We do not use your data for advertising.
SMS / Text Message Program
BSA sends operational alarm notifications by SMS to account owners and designated contacts who opt in.
What you receive: operational alarm and governance alert notifications about the Platform (for example, CloudWatch alarm state changes). No marketing or promotional messages.
Opt-in: self-initiated by the account owner or contact — you request verification, receive a one-time passcode by text, and confirm it.
Message frequency: varies with operational conditions; typically fewer than 100 messages per month.
Message and data rates may apply.
Opt out at any time: reply STOP to any message. You will receive a final confirmation and no further texts.
Help: reply HELP to any message, or contact privacy@safeforhumanity.com.
No third-party sharing: mobile telephone numbers and SMS opt-in consent are not shared with, sold to, or transferred to third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third party.
How We Share Information
Subprocessors. Amazon Web Services, Inc. (infrastructure and storage) and PagerDuty (incident alerting — system identifiers and alert levels only, no governance data). We give at least 30 days' notice before engaging a new subprocessor.
Partner firms. If your organization accesses the Platform through a partner engagement, the partner firm has access to the governance data relevant to your systems, governed by your agreements.
Regulatory authorities. We may disclose information when required by law or court order; where legally permitted, we notify you first.
Certification registry. Certification status (active, suspended, withdrawn) for registered AI systems is published in BSA's public certification registry — a necessary, intended feature of the service.
Business transfers. If BSA merges or is acquired, information may transfer with the business; we notify you of any material change in data controller first.
We do not sell personal information.
Security
AES-256 encryption at rest (AWS KMS); TLS 1.3 in transit; multi-factor authentication on all accounts; role-based access control; write-once audit records with cryptographic signing. Governance Audit Records are stored with S3 Object Lock in Compliance mode — they cannot be modified or deleted by any party, including BSA, during retention — signed with keys managed in hardware security modules, and replicated across two geographic regions.
Your Rights
Depending on your location, you may have the right to: access a copy of your personal data; correct inaccurate data; request deletion where no legal basis for retention applies; restrict or object to certain processing; receive your data in a portable format; withdraw consent where processing is based on consent; and complain to your data protection authority. Exercise any of these by emailing privacy@safeforhumanity.com; we respond within 30 days.
California residents: you have the right to know what personal information we collect, the right to request deletion, the right to opt out of sale (BSA does not sell personal information), and the right to non-discrimination for exercising these rights.
A note on audit records: Governance Audit Records are immutable and retained for a minimum of 10 years because our clients' regulatory obligations require it. The right to erasure does not apply to data whose retention is a legal obligation; we will document that basis on request.
Cookies
The Platform uses essential cookies only (session management, CSRF protection, MFA state). No advertising cookies, no behavioral tracking, no data shared with advertising networks.
Data Retention
Governance Audit Records: 10 years minimum. Account and user data: duration of the account plus 5 years. Configuration history: contract plus 7 years. Security logs: 90 days (7 years for incident records). Support communications: 2 years from resolution. Billing records: 7 years.
Changes to this Policy
We will notify you of material changes by email to your registered address at least 30 days before they take effect. Continued use of the Platform after the effective date constitutes acceptance.
Contact
Privacy: privacy@safeforhumanity.com
Security incidents: security@safeforhumanity.com
Mail: Boundary Stabilization Authority, LLC
6265 Greenwich Dr. #210
San Diego, CA 92122
United States