FOLLOW YOUR CURIOSITY
No pages match this search. Try a broader term such as “workflow”, “review” or “knowledge”.
Ask us directlyTRUST CENTRE
The company behind the work. The way information moves. The questions worth settling before an engagement begins.
Download the essentialsKEEP THE USEFUL DETAILS
Two concise documents for an initial business or procurement review. Reviewed 10 October 2026.
INFORMATION FLOW
Explore what happens when you use the website’s different services.
Your message becomes a conversation in the restricted studio inbox. Notification and message content take different paths.
The form receives the contact details and business context you choose to share.
Inquiry content is encrypted before it is saved in the website database.
Authorized administration reads the saved message and can reply by email.
The administration notification contains an inbox link, not the inquiry body. Accepted incoming emails may also be forwarded to the business mailbox.
A shared project space for proposals, milestones, decisions, messages, and files. Membership controls which project material a client can access.
An authorized email receives a time-limited, one-time sign-in code.
The server checks active membership and whether the project is open.
Authorized members can access the project records and files stored encrypted in the database.
An administrator manages membership. Removing membership or closing a project withdraws client access. Approval records identify the member and the version reviewed.
The guided brief can help frame a business conversation without submitting information simply because you started writing.
Your entries stay in the current page memory while you work.
The PDF is generated in your browser. Exporting alone does not send it to Ayan.
Choosing to send submits the brief through the inquiry service.
A downloaded PDF is a copy on your device. If you send the brief, its submitted contents follow the inquiry service’s access and retention rules.
Unsent draft: current page memory. Sent brief: inquiry retention.
Prepare an executive briefThe meeting form records your preferred times and business context for review. It does not book a slot automatically.
Contact details, purpose, time zone, and preferred times form the request.
The request is stored encrypted and available to authorized administration.
An administrator decision can send email; a confirmed time can include a calendar invitation.
Email delivery is separate from saving a decision. Meeting and calendar messages are processed by the relevant mail providers.
Eligible for cleanup 365 days after the later of the last update and meeting time.
Request a conversationSECURITY & ACCESS
These controls describe the website and its client workspace. The design of a separately delivered client system is agreed for that engagement.
Inquiry, workspace, and meeting content is encrypted in the website database using AES-256-GCM. Operational metadata such as identifiers, timestamps, statuses, and keyed lookup values remains available to run the service.
The service can decrypt content for authorized use. This is not end-to-end encryption.
Administrator and client-workspace sign-in use separate sessions. The server checks authorization; project membership controls client access to project records and files.
Twelve-hour authentication cookies use Secure, HttpOnly, and SameSite=Strict attributes.
Workspace writes check revisions and request identifiers to handle concurrent changes and duplicate requests. An approval records the member and the version reviewed.
A changed version requires a new review; it does not silently inherit an earlier approval.
The public website has no advertising trackers or third-party analytics. An inquiry does not subscribe you to a marketing list, and the inquiry workflow does not send submissions to a generative AI model.
Hosting infrastructure still processes technical and security information needed to operate the service.
Cloudflare provides hosting, network protection, the database, and email transport. Ordinary email is processed by the relevant mail providers. Those provider boundaries also apply to replies and accepted inbound email forwarded to the business mailbox.
Read the provider and disclosure detailsRETENTION
Cleanup follows the record’s purpose and activity. Removing website records does not automatically remove copies in other systems.
365 days without activity
Daily cleanup removes conversations after 365 days without new activity. Incoming messages and newly recorded outgoing reply attempts restart the period. Reading or archiving does not extend it.
365 days after closure
Open projects remain available. Closed project records and files are scheduled for daily cleanup after 365 days from closure. Reopening cancels that cleanup; revoking membership does not delete the project.
365 days after the later event
Requests become eligible for cleanup 365 days after their last update or their confirmed meeting time, whichever is later. For an unconfirmed request, the latest requested time is used. Cleanup is batched.
Expired authentication and request-limiting records are also cleaned up. Separate mailboxes, infrastructure logs, backups, and engagement systems have their own retention processes.
Make a privacy requestBEFORE THE WORK BEGINS
A useful review starts with the work you intend to commission. Share your procurement checklist and the conditions that matter to your organization before project information is exchanged.
Discuss procurementIdentify the data categories, sensitivity, source systems, and people whose information may be processed. Establish what can be shared during discovery and what needs a separate channel or agreement.
Agree who owns system accounts, who can approve access, which providers are permitted, and whether location or transfer requirements apply. Website hosting does not establish a data-residency commitment for an engagement.
Set deliverables, exclusions, client responsibilities, acceptance criteria, fees, and delivery dependencies in the services agreement. Address confidentiality and a data-processing agreement where appropriate.
Define handover, support, access removal, retention, and deletion responsibilities. A pilot or discovery engagement does not automatically include ongoing hosting, maintenance, or future development.
PUBLIC COMPANY INFORMATION
An applied AI and automation studio, operating under the Ayan brand.
USEFUL DISTINCTIONS
Use the initial inquiry for an appropriate business introduction. Do not send passwords, payment details, sensitive personal information, or confidential project documents. Agree the data boundaries and a suitable channel before sharing that material.
Identify the certification, independent audit, insurance, contractual terms, or supporting documents your process requires. Confirm what evidence is available and what commitments can be agreed before treating a requirement as satisfied.
No. Providers may process information in more than one jurisdiction. If an engagement requires a particular data location or transfer arrangement, address it in the architecture and contract before data is shared.
Email hello@withayan.com with “Security concern” in the subject. Describe the affected page and observed behavior, with enough context to investigate. Do not include credentials, secrets, or unrelated personal data.
Policies and service terms