Overview
Fastino.ai gives developers a set of AI models and APIs to build on. Trust is part of the product. This page explains the controls we run behind the API, what happens to the data you send us, and how we work to keep our models safe to deploy. It is written for the engineers integrating Fastino.ai and the security teams reviewing us. If you need something not covered here, such as a security questionnaire, subprocessor list, or a signed agreement, reach out at security@fastino.ai.Data security
Encryption
All data is encrypted in transit using TLS 1.2 or higher. Data at rest is encrypted using AES-256. API traffic is served exclusively over HTTPS, and requests over unencrypted channels are rejected.Infrastructure
Fastino.ai runs on AWS, which maintains its own physical and environmental security controls. Our production environment is isolated from development and staging, with separate VPC CIDRs and restrictive security groups, and network access is restricted by default.Access control
Access to production systems and customer data is limited to the employees who need it, granted on a least-privilege basis, and reviewed regularly. We require single sign-on and multi-factor authentication for internal systems, and access is revoked promptly when someone changes roles or leaves.Secure development
Changes to production go through code review and automated testing before they ship. We use dependency scanning and static analysis in our pipeline, keep an audit trail of deployments, and patch known vulnerabilities on a defined timeline.Authentication for developers
API access is authenticated with per-team API keys. A key is bound to a team and can access every project in that team, so treat each key as team-wide. We recommend you store keys in a secrets manager, set an expiry where appropriate, and never commit them to source control. Keys can be revoked at any time from the dashboard.Privacy & data handling
What we collect
When you call the API we process the inputs you send (prompts, files, and parameters) and return outputs. We also collect operational metadata such as request timestamps, token counts, and error logs to run and secure the service.Do we train on your data?
Sometimes, by default. Unless you opt out, we may use inputs and outputs you send through the API to improve and train our models. Enterprise customers can opt out of platform training in Settings. Separately, your inference data is used for continuous adaptation and remediation training of your own task models. That task-model training applies regardless of the platform-training opt-out and is not affected by the toggle.Retention
By default, API inputs and outputs are retained indefinitely to support debugging, abuse detection, and service reliability and improvement. Stored payloads tier to colder storage over time but are not automatically deleted. For eligible use cases, you can setstore: false on a request for full zero-retention handling, in which case the input and output are never written to storage.
We use a small set of third-party providers to deliver the service (for example, cloud hosting and monitoring). A current list of subprocessors is available below. We update it before adding a new subprocessor that handles customer data.
Subprocessors (last updated July 30, 2026):
Data subject requests
If you or your users need to access, export, or delete personal data, contact security@fastino.ai and we will respond within the timelines required by applicable law.AI safety & responsible use
Because Fastino.ai ships AI models, safety is not only an infrastructure question. Here is how we work to make our models safe to build on and how we expect them to be used.Model safeguards
Our models are trained and evaluated with safety in mind, including filtering of harmful content and testing against known misuse patterns before release. We continue to evaluate models after launch and update safeguards as new risks emerge.Content moderation
We offer optional input-side safety filtering to help you flag potentially harmful prompts. Filtering applies to inputs only; we do not filter or reject model outputs. Detection is geared toward abuse patterns such as jailbreaks, weapons, malware, and account abuse, and can surface categories like hate, harassment, and explicit content, though it isn’t purpose-built or evaluated for those. These filters are off by default and run only where your risk policy enables them. You remain responsible for moderation appropriate to your own product and users.Acceptable use
Use of Fastino.ai is governed by our Terms of Service. In short, do not use our models to generate illegal content, to harm or deceive people, to build surveillance or profiling systems that violate rights, or to attempt to bypass our safety controls. We may suspend access for violations.Human oversight
AI output can be wrong or biased. For decisions that affect people (such as hiring, credit, healthcare, or legal outcomes) we ask that you keep a human in the loop rather than relying on model output alone, and that you disclose to your users when they are interacting with AI.Bias & limitations
Our models reflect patterns in their training data and can produce inaccurate or skewed results. We test for common failure modes and document known limitations in our model documentation so you can decide where the models are and are not appropriate to deploy.Compliance & certifications
SOC 2 Type I
Fastino has completed an independent SOC 2 Type I examination. The resulting report evaluates whether our in-scope controls were suitably designed and implemented as of a specified date. A Type I report does not assess how effectively controls operated over an observation period; that is the focus of a Type II examination. To request our SOC 2 Type I report, which we share under NDA, email security@fastino.ai.In progress
- SOC 2 Type II: We are in the observation window and expect to complete the examination in November 2026.
- ISO 27001: Our certification work is underway.