We sell private AI and cybersecurity, so this page is written with the same rule we apply to code: no claims you can't check. Here is what we do today, what we commit to doing and what we still don't have.
Your data is yours. We don't sell it, we don't pass it on and we don't use it to train models. We design so that as little information as possible leaves your network — and when something does leave, we tell you exactly what, where to and why.
You won't find the word "unbreakable" on this page, nor a certification badge we don't hold. A vendor that promises zero risk is either lying to you or hasn't read their own logs.
Altaïr is deployed in two ways, and the answer to "does my data leave my network?" depends on which one you choose. Here is the real difference:
The models run on infrastructure you control: your server, your private cloud, your data center. Your documents, your conversations and the model's answers are processed inside that infrastructure. Inference does not travel to an external model provider.
What can leave, and it's worth saying so: the traffic from the channels you connect. If you use WhatsApp Business or Instagram, those messages pass through Meta before reaching Altaïr — that's a property of the channel, not of us. If you enable external tools (email, CRM, a cloud ERP), Altaïr talks to them. Every integration is listed and approved with you before it is switched on.
It's the entry point for the smaller plans. Here processing happens on infrastructure we operate and, depending on the configuration, inference may run on external model providers. In this mode we cannot claim that your data never leaves your network — because it does.
What we do instead: we give you in writing, before signing, the exact list of providers involved, what content they receive and under what terms. If your requirement is that no data leaves, the right mode is on-premise; we'll tell you so even though it's the most expensive plan.
On the managed mode, Altaïr can have more than one model provider configured: if one fails, there is another behind it so the service doesn't go down. In an on-premise deployment, that fallback is configured with you and can be restricted to local models.
In an on-premise deployment, the keys and the storage are under your operational control: we configure, you hold custody. If you need a specific technical detail — algorithms, key rotation, log retention — we deliver it in writing during the evaluation, we don't summarize it on a marketing page.
No. Commitment We don't use your documents or your customers' conversations to train or fine-tune models, nor to improve a product we sell to someone else. Altaïr queries your documents at the moment of answering (RAG); it doesn't absorb them into the model. When an external provider is involved, we sign up for the option that doesn't train on the content sent, and we tell you which one it is before signing.
It depends on the mode, and this is the honest answer: on-premise, no — inference happens on your infrastructure. Managed, probably yes — most frontier model providers operate from the US. If your regulatory framework doesn't allow it, the on-premise deployment exists for exactly that.
We assume it will get things wrong; the design takes that into account. Altaïr answers only from your documents and cites where it got each answer from, so it can be checked instead of believed. When it isn't sure — a price, a policy, an exception — it says so and escalates to a person instead of improvising. Before going live we test it with real questions from your business and you review the answers. You get a panel to supervise what it answers.
What we won't tell you: that it never hallucinates. No language model offers that guarantee today. What we do offer is that it's checkable — with a citation — and that it knows when to shut up and hand the conversation to a human.
Everything in this section you can check right now with your browser's developer tools or with curl -I. We include it because a security vendor's posture starts with its own website.
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; font-src 'self' data:; img-src 'self' data: https:; connect-src 'self' https://deepreckon-contact.antoninosalcie.workers.dev; base-uri 'self'; form-action 'self' https://deepreckon-contact.antoninosalcie.workers.dev; object-src 'none'; frame-ancestors 'none' Strict-Transport-Security: max-age=63072000; includeSubDomains; preload X-Content-Type-Options: nosniff X-Frame-Options: DENY Referrer-Policy: strict-origin-when-cross-origin Permissions-Policy: camera=(), microphone=(), geolocation=(), browsing-topics=() Cross-Origin-Resource-Policy: same-site
The CSP doesn't allow scripts or styles from external domains, forbids object-src, blocks framing of the site and restricts outbound connections to a single origin: our form endpoint. Critical pages repeat the policy in a meta tag, so it still applies even if the site is served from different hosting.
The site loads nothing from outside. The typefaces (Manrope, Space Grotesk, IBM Plex Mono) are served from /fonts/ as our own .woff2 files; the JavaScript is on the site; the images are on the site. There's no Google Fonts, no external CDN, no embedded scheduling widget — the scheduler is ours — no advertising pixel, no third-party chat. Open the network tab: the only request that leaves the domain is the POST from the contact form, and only if you send it. You'll also see requests to /_vercel/insights and /_vercel/speed-insights: that's the visit measurement from our own hosting, served from this same domain, and we explain it right below.
We don't use Google Analytics, or Meta Pixel, or any advertising platform. We do use Vercel Web Analytics and Speed Insights, the built-in measurement of our own hosting, and we'd rather say it here before you see it in your network tab.
What that means, specifically: it sets no cookies or persistent identifiers; it records aggregate data (page, referrer, country, device type, speed metrics); the script and the transmission come from deepreckon.com/_vercel/…, which means no request goes to a third party; and it isn't cross-referenced with what you type in the form. The only thing we store in your browser is still the language you chose (localStorage), and it doesn't leave your device.
We say it because on this page the criterion is that everything be checkable: "we don't use analytics" would have been nicer and would have been false.
The contact form is received by a Cloudflare Worker we wrote ourselves. Layered defense, exactly as it is in the code:
403.429.413; each field has its own length limit and is truncated.422.nosniff, X-Frame-Options: DENY, Cache-Control: no-store, Referrer-Policy: no-referrer.The site is static and the endpoint doesn't store your message in any database: it turns it into an email, delivers it and finishes. The only thing stored is a rate-limit counter, keyed by your IP and a ten-minute window, which expires on its own. There are no profiles, no history, nothing to leak because there's nothing stored.
Who touches the data from this site and its form, what for and where. If anything changes, it's updated here.
| Provider | What for | What it processes | Where |
|---|---|---|---|
| Vercel | Static site hosting and visit measurement (Web Analytics + Speed Insights) | Request metadata (IP, user agent) in their logs, and aggregate visit and speed metrics, with no cookies or persistent identifiers. No form content. | US / global network |
| Cloudflare Workers + KV |
Form endpoint and per-IP rate limit | The form fields, in transit. In KV only a counter with your IP and the 10-minute window; it expires on its own. | US / global network |
| Resend | Transactional email delivery | Name, email, company, budget or timeline, preferred time and your message, in order to deliver them. | US |
| Google |
The inbox where we receive your message | The email with what you wrote in the form. | US |
An Altaïr deployment has its own list of subprocessors, and it depends on the mode: in on-premise it can be none for inference; in managed it includes the model providers. The specific list for your deployment is delivered in writing before signing, not after.
Today we hold no security certification. No SOC 2, no ISO 27001, no third-party audit. We could write "SOC 2-aligned practices" — the phrase everyone uses when they have nothing — but that's exactly the kind of ambiguity a security team spots and punishes.
What we do have is a concrete, checkable technical posture (section 05 is the proof) and the willingness to answer any security questionnaire in detail and in writing.
What's on the roadmap, with no committed date:
When any of these exists, it will appear here with its date and its scope. As long as it doesn't appear, it doesn't exist.
If you find a security flaw in this site, in the form endpoint or in an Altaïr deployment, we want to know. Write to us through the contact form (or via LinkedIn if the site is down) with the steps to reproduce it and the impact you see. You can also write directly to hello@deepreckon.com.
Our commitment: Commitment
We have no paid bounty program today. We say it up front so we don't waste your time.
DeepReckon is in the process of being formally incorporated. We operate from the Dominican Republic and work with clients in several countries.
Company details for procurement and vendor onboarding. While registration is being completed, we don't publish a registered company name, legal form or tax identification number here — because doing so with provisional details would be inaccurate. As soon as the entity is incorporated, they will be published on this page. If your procurement or legal team needs to move forward sooner, write to us through the contact form and we'll arrange in writing whatever is needed, along with your security questionnaire.
This page describes DeepReckon's real situation as of 14 July 2026. If we add a certification, change a subprocessor or modify how we handle data, it's updated here and the date changes. If you spot anything on this page that doesn't match what you see in the product, write to us: that's a security report too.