Security & Data Handling
The trust page, written the way we intend to be held to it
These are commitments, not adjectives. Each one is drawn from GEN's internal permission matrix; where a mechanism is still planned rather than implemented, this page says so instead of dressing it up.
The permission model, in plain language
- Company boundaries are the default. Each company — parent, subsidiary, or participating client — holds its own records in its own workspace.
- Parent oversight is aggregate-only — counts, stages, status, health — or by explicit logged grant. Record-level access is granted by the company owner, scoped to what is needed, logged when used, and revocable by the owner at any time. There is no silent full access.
- Sharing is per-record and voluntary. An operator shares a coded folder when they want help. Adopting the framework's numbering never, by itself, shares anything.
- Identity stays home. Work shared across firms travels in shared form — a reference code with no client name attached. The map between names and codes lives only in the owner's own registry.
No pooling, no silent matching
There is no automatic cross-company data pooling, and no automatic cross-tenant identity matching. Two companies in the same group can hold records about the same outside party and the framework will not silently merge, enrich, or compare them. Anything that crosses a company boundary crosses it by a named person's explicit action, under a grant, on the record.
Ownership & exit
The client owns its records, its configuration, and its documentation. Export in a complete format is the owner's right — exercised by the owner, not begged for. Export and transition terms belong in the engagement contract, stated as terms to be agreed before work begins; we describe them that way because a promise that only exists on a web page is not a term.
Human approval gates
- Publication of anything public requires the owner's approval; building something and approving its release are separate decisions.
- External communications are drafted by the system and sent by a human. Automated greetings, replies, and follow-up sequences stay off unless a human owner turns them on deliberately.
- Imports require a fresh check of every workflow trigger before they run, so an import can never silently activate sending. This rule is written from a real incident class, not theory.
- Production actions — connecting a provider, changing a standard, issuing a registry number — are one-at-a-time, approved, and verified after the fact.
What GEN will not claim
Security and encryption capabilities are described only as implemented and verified. Anything not yet implemented is labeled planned — including parts of this model that are currently enforced by process and review rather than by finished software. GEN holds no certifications it could display here, and displays no badges it has not earned. If you need a control verified, ask in the consultation and we will show you its current state, whatever that state is.
Privacy questions and data requests: use the consultation form and mark your message as a privacy request; an operator routes it personally.
Check us before you trust us
That is what this page is for. Bring your hardest data question to the first conversation.