AI Policy

Get in Touch with us!

How We Build, Govern, and Use Artificial Intelligence Responsibly

This AI Policy explains how Xicom Technologies Ltd. ("Xicom", "we", "our", or "us") develops, governs, and uses artificial intelligence, both in client engagements and in our own internal workflows. It covers the principles we follow, how we handle data across AI projects, how we evaluate third-party AI tools, and what clients and employees can expect from us in return.


We may update this policy from time to time as regulations, tools, and our own practices evolve. We encourage you to review this page periodically to stay informed of any changes. Continued use of our website or services after an update is considered acceptance of the revised policy.

Table of Contents

Scope

This policy applies to:

  • AI and machine learning systems Xicom designs, builds, or deploys for clients
  • Any Xicom employee or contractor who uses AI tools, including generative AI, as part of their work
  • Third-party AI tools, platforms, and foundation models used on client engagements or internally

It covers how data is handled, how AI systems are reviewed before and after deployment, and what clients and employees can expect from us in return.

Our Principles

These principles are not a mission statement sitting separately from delivery. They are what our project leads and engineers are expected to apply on every AI engagement.


  • Accountability - Every AI project has a named owner responsible for data handling and model behavior, assigned before development starts.
  • Transparency - Clients know what data went into a model, how it was built, and where its limitations are. We do not overstate what an AI system can reliably do.
  • Data Minimalism - We work with the data an AI system needs, not more. Scope is agreed before ingestion begins.
  • Human Oversight - AI outputs that carry real consequences, financial, medical, or operational, pass through a human checkpoint before they are acted on.
  • Client Ownership - Data a client shares for their project stays theirs. It is not reused to train models for other engagements or shared outside agreed scope.
  • Fairness - Models are checked for bias relevant to their use case before they move from development to staging.

Risk Management Objectives

AI systems carry different risks depending on what they do and what data they touch. Our approach is to identify those risks early rather than address them after something goes wrong.


  • Data risk - exposure of personal, sensitive, or confidential business data through training, inference, or logging.
  • Model risk - biased outcomes, unreliable outputs, or a model behaving outside its intended use case.
  • Vendor risk - third-party AI tools with weak data protection, unclear model training practices, or unfavorable data terms.
  • Regulatory risk - non-alignment with data protection and AI-specific regulation relevant to a client's industry or region.

Each of these is addressed at a specific stage of the AI development lifecycle below, not as an afterthought.

Data We Work With

AI engagements involve different categories of data, and each is handled according to its sensitivity rather than a single blanket rule.


  • Personal and sensitive data (names, contact details, financial or health information) - strictest access controls, need-to-know basis, logged access.
  • Client business data (pricing, operations, internal processes) - treated as confidential, used only within agreed project scope.
  • Training and evaluation data - source and preparation documented, client has visibility.
  • Synthetic and anonymized data - used by default in development and testing where practical.

Governance Across the AI Development Lifecycle

Governance is built into how a project moves from scoping to deployment, not applied as a review at the end.


  • Scoping - Data needs, sources, and restrictions agreed with the client before any ingestion.
  • Development - Access controls, data validation, and version tracking for datasets and models built into the pipeline.
  • Model review - Performance and bias checks against the use case, carried out as part of our AI governance process, with sign-off required from the project's governance owner before a model progresses.
  • Pre-deployment audit - Data handling, access permissions, and documentation reviewed before go-live.
  • Post-deployment monitoring - For engagements with ongoing support, model behavior is tracked and anomalies are flagged for review.
  • Change management - Model updates, new data sources, or new use cases go through a governance review before they ship.

AI Security Standards

Beyond process, we apply baseline security controls to any AI system we build or operate:


  • Role-based access to training data, model artifacts, and inference endpoints
  • Encryption of data in transit and at rest within AI pipelines
  • Logging of access to sensitive datasets used in AI development
  • Isolation of client data between engagements, with no cross-client data pooling for model training

Third-Party AI Tools and Vendors

Where a client engagement or internal workflow uses a third-party AI tool or foundation model, it goes through an internal evaluation first. We look at how the vendor handles data, what contractual protections apply, and whether data passed to the tool could be used to train the vendor's own models. Tools that fall short on data protection are not used on client work, regardless of how useful they might otherwise be. Clients can request to know which third-party AI tools were used on their engagement.

Internal Use of AI at Xicom

Our own teams use AI tools, including generative AI, to support day-to-day work. This is governed the same way client-facing AI use is:


  • Client data and confidential information are not entered into public or unapproved AI tools
  • Only AI tools that have passed our vendor evaluation are approved for work involving client data
  • Employees are expected to review AI-generated output before it is used in client deliverables, code, or communication
  • Access to AI tools is tied to role and revoked when no longer needed

Regulatory and Compliance Alignment

Our AI development practices are structured around the regulations and standards most relevant to enterprise software and AI work. Which of these apply to a given engagement depends on the client's industry and region, confirmed during scoping.


  • GDPR (General Data Protection Regulation)
  • HIPAA (Health Insurance Portability and Accountability Act)
  • CCPA (California Consumer Privacy Act)
  • SOC 2 (System and Organization Controls 2)
  • EU AI Act
  • ISO/IEC 42001 (AI Management System Standard)
  • NIST AI Risk Management Framework

Where applicable, we structure our processes, access controls, and documentation practices to support alignment with these frameworks for the relevant category of data and client engagement.

Transparency and Accountability

Principles need enforcement behind them. This is what that looks like in practice:


  • Visibility - Clients can request a summary of what data was used in their AI project and how it was processed.
  • Model documentation - Training data sources, evaluation results, and known limitations are documented for every model we build or fine-tune.
  • Data removal - A defined process exists to remove specific data from training sets, pipelines, or storage on request.
  • Audit support - We provide documentation and support if a client faces an internal or external audit involving a system we built.
  • Incident notification - If a data-related incident occurs within an engagement, clients are notified promptly, with updates as the situation becomes clearer.

Continuous Improvement

AI regulation, tooling, and best practice are all moving quickly. This policy is reviewed periodically to reflect changes in the regulatory landscape, in the AI tools available to us, and in how our own delivery practices evolve. What is published here reflects how Xicom works today.


Xicom has delivered software for enterprise clients for more than 20 years, across 750+ clients and 1,800+ projects in 50+ countries. Our processes align with ISO 9001, and we hold NASSCOM and STPI accreditations. AI is treated with the same operational discipline as every other system we build and ship.

Contact Us

If you have any questions about this AI Policy or how we handle data in a specific engagement, please write to us at [email protected].


Chat