Security Practices

NobleOps AI builds custom AI revenue infrastructure and operational workflows for growth-stage service companies. Because this work may involve lead data, workflow logic, CRM fields, automation platforms, reporting systems, API payloads, and business process information, we approach security with practical safeguards and clear access boundaries.

Our security approach is guided by four priorities:

• access only what is reasonably needed for the work;
• use client-owned accounts and scoped permissions where practical;
• keep humans in control of sensitive workflow decisions;
• design systems with clear documentation, testing, and handoff practices.

We aim to follow a least-privilege approach. This means we request only the level of access reasonably required to perform an agreed audit, workflow design, automation build, system test, or support task.

Where possible, we prefer scoped permissions, restricted user roles, test environments, sandbox data, temporary access, read-only access, or client-supervised access instead of broad administrator-level access.

If broader access is required for a specific technical task, we aim to explain why it is needed and encourage the client to review, approve, and revoke access when the work is complete.

For most implementations, we prefer that clients own and control the core accounts used in their business workflows, including CRM systems, email platforms, calendar tools, automation platforms, analytics tools, AI/API accounts, and cloud storage.

Client-owned accounts help ensure that the client maintains long-term control over billing, access, data, permissions, audit history, integrations, and continuity after project handoff.

We may help configure systems, create workflows, document integrations, or advise on tool setup, but clients remain responsible for maintaining their own accounts, credentials, billing, user permissions, and internal access controls unless a separate written agreement says otherwise.

We encourage clients to avoid sharing passwords directly when a safer access method is available. Preferred options may include invited user accounts, role-based permissions, delegated access, API keys with limited scope, temporary credentials, or secure credential-sharing methods.

Clients should not submit passwords, API secrets, confidential customer files, regulated data, or sensitive operational information through public website forms, email, chat widgets, or unapproved channels.

When credentials, API keys, or access tokens are required for a project, the handling process should be agreed in the relevant statement of work, onboarding process, or secure implementation workflow.

We aim to minimize the amount of data we access, collect, copy, export, or process. Where possible, we use sample data, redacted data, test records, limited fields, or structured examples instead of broad production datasets.

For workflow audits, automation builds, reporting systems, and AI-supported processes, we generally focus on the information needed to understand the workflow, validate system logic, and confirm that the agreed implementation works as intended.

Some client workflows may involve AI APIs, language models, automation platforms, CRM integrations, webhooks, reporting tools, or other third-party services. When these tools are used, we aim to limit the information sent to what is reasonably needed for the approved workflow.

NobleOps AI does not use client revenue data, lead information, pipeline metrics, workflow data, or submitted operational information to train public large language models or public foundational AI models.

Where AI APIs or business AI platforms are used, we aim to use business/API settings and providers intended for private processing where available. Third-party providers maintain their own terms, privacy policies, retention settings, security practices, and infrastructure, so clients should review and approve the tools used in their workflow.

AI and automation can support faster execution, but sensitive business actions should not always be fully automatic. We design human approval checkpoints where appropriate, especially for workflows involving client communications, CRM updates, lead scoring, proposal preparation, sales follow-up, reporting summaries, or other revenue-impacting actions.

Depending on the workflow, human approval checkpoints may include draft review, manual send approval, status confirmation, quality checks, exception review, escalation rules, or final client acceptance testing before activation.

Clients remain responsible for supervising live workflows, reviewing outputs, approving sensitive actions, and training their teams on the proper use of the system unless a signed agreement states otherwise.

Custom revenue operations systems often rely on third-party platforms such as CRMs, form tools, email systems, calendars, automation platforms, AI API providers, analytics tools, cloud storage, and communication platforms.

These third-party providers control their own uptime, security controls, access models, billing rules, API limits, product changes, data retention practices, and privacy policies.NobleOps AI is not responsible for third-party outages, API failures, rate limits, security incidents, pricing changes, permission changes, deprecated features, or policy updates.

We aim to design workflows with practical awareness of these dependencies, but no connected system can be guaranteed to operate without interruption or third-party risk.

Before a workflow is considered ready for use, we aim to test the agreed system logic, triggers, routing, notifications, data fields, AI prompts, edge cases, and expected outputs. The exact level of testing depends on the scope of the engagement.

We may use test records, sample scenarios, staging steps, review checklists, walkthroughs, documentation, or acceptance testing to help validate the workflow before handoff.

Final launch approval, production use, and internal adoption are the client’s responsibility unless a written agreement provides otherwise.

Security is not only technical. Clear documentation helps teams understand what a system does, where data flows, which tools are connected, who is responsible for approvals, and what to do if something needs review.

Where appropriate, we provide implementation notes, workflow documentation, handoff materials, approval guidance, or basic operating instructions so the client’s team can use the system with more confidence.

If we become aware of a security issue involving our website, tools, accounts, or a client workflow we are actively supporting, we aim to assess the situation and take reasonable steps based on the nature of the issue, the data involved, and the systems affected.

Depending on the circumstances, reasonable steps may include restricting access, rotating credentials, disabling integrations, notifying affected parties, contacting relevant providers, preserving key information, or supporting the client in investigating the issue.

Clients are responsible for monitoring their own systems, maintaining internal incident response processes, managing user access, and notifying affected parties or regulators where required by applicable law.

Security is shared between NobleOps AI, the client, and the third-party tools involved. Clients are responsible for:

• maintaining secure passwords and account access;
• using multi-factor authentication where available;
• reviewing and approving user permissions;
• removing access for former employees, vendors, or contractors;
• reviewing third-party tool terms, privacy policies, and settings;
• training team members on proper system use;
• reviewing AI-generated or automation-generated outputs;
• approving workflows before production launch;
• monitoring live systems after handoff;
• complying with applicable privacy, security, industry, and customer obligations.

We take security seriously, but no website, software system, cloud platform, AI tool, API, automation workflow, internet transmission, or electronic storage method can be guaranteed to be fully secure, uninterrupted, or error-free.

This page describes current practices and general principles. It does not represent a guarantee, warranty, certification, formal audit, penetration test, SOC 2 report, ISO certification, compliance attestation, or legal advice.

Our handling of personal information is described in our Privacy Policy. Website use is governed by our Terms of Use. This Security Practices page should be read together with those documents.

You can review them here: /privacy and /terms.

We may update this page from time to time to reflect changes in our tools, services, workflows, security practices, operational practices, legal requirements, or third-party providers. The updated version will be posted on this page with a revised "Last updated" date.

If you have questions about these Security Practices or how security is handled during an engagement, contact:

NobleOps AI
Toronto, Ontario
Email: hello@nobleops.ca