TRUST & SAFETY.

How We Collect Data

Our collection follows a consent-first protocol:

• Contributors are 18 or older, recruited directly, and onboarded in their own language
• Consent is given separately for capture, annotation, model training, delivery to customers and retention. Agreeing to one never implies agreeing to another
• We record which version of the consent terms each contributor accepted. Any change to how we use their data needs fresh consent
• Contributors can pause or stop recording at any time, and devices show a visible recording indicator
• Bathrooms, hospitals, schools, places of worship and any space a contributor or household marks off-limits are never recorded
• We do not knowingly record minors. Clips that show children are excluded, not blurred
• Audio is off by default and captured only with separate consent

Bystander and Privacy Protection

People who never signed up to be filmed are protected too:

• Households and workplaces give permission before any recording takes place there
• People who appear on camera without having consented are blurred, or the clip is removed. Every decision is logged with the policy version applied
• Automated detection and human review cover faces, license plates, screens, documents, addresses and ID cards
• Only our privacy review team can see raw, unredacted footage. Annotators and customers receive redacted data

Contributor Rights

Contributors stay in control of their data:

• They can ask to access, correct or delete their data under the DPDP Act and GDPR
• Withdrawing consent removes their clips from all future datasets and deliveries
• Grievances are handled by our designated grievance contact at raushan@xphirobotics.com

Data Lifecycle

• Before every delivery, a release audit checks consent scope, redaction status, license terms and geographic restrictions
• Raw footage is kept only as long as privacy review needs it, then deleted
• Datasets are deleted once they are no longer needed for the purposes contributors consented to

Device Security

The cameras themselves are part of our security:

• Footage is encrypted on the device and uploaded only over encrypted connections
• Each device is registered to one enrolled contributor
• Lost or stolen devices can be remotely locked and wiped
• Device software is centrally managed and kept up to date

Infrastructure Security

XPhi Robotics runs on enterprise-grade cloud infrastructure across multiple availability zones with automatic failover:

• Network segmentation and firewall rules to isolate sensitive workloads
• Intrusion detection, DDoS protection, and regular vulnerability scanning and patching
• Immutable infrastructure with automated deployment pipelines
• Automated daily backups with encrypted offsite storage and tested restoration procedures

Data Security

Your data is protected by several layers of controls:

• AES-256 encryption at rest and TLS 1.2 or higher (1.3 preferred) in transit
• Managed cryptographic keys with restricted access
• Each customer’s data is kept separate from other customers' data
• Every access to or download of raw footage is recorded in an audit log

Operational Security

Our operational security practices:

• Background checks, privacy training and confidentiality agreements for everyone who can view footage
• Multi-factor authentication on all internal systems
• Least-privilege access with regular access reviews
• 24/7 monitoring, anomaly detection and audit logging of all administrative actions
• Regular penetration testing and security code reviews
• A documented incident response plan. Affected customers and regulators are notified without undue delay, as the law requires

For Customers

Every dataset arrives ready for procurement and security review:

• A dataset card listing contributor count, regions, consent scope, redaction methods and license terms
• Secure delivery through encrypted bucket transfer, signed links that expire, or directly into your own cloud storage
• A Data Processing Agreement, subprocessor list and security documentation on request, under NDA

Vulnerability Disclosure

We take security reports seriously and thank researchers who disclose responsibly. If you find a possible vulnerability in our platform, please report it to us privately before you disclose it publicly.

When reporting, please include:

• A description of the vulnerability and its potential impact
• Steps to reproduce the issue
• Any supporting screenshots or non-destructive proof of concept

Out of scope: social engineering, physical attacks, denial of service, and any attempt to access contributor footage.

Contact