Before an AI model ships, its training data has usually been opened, read and labelled by people outside the company that owns it. That makes every data partner part of your security perimeter, whether the contract says so or not.

When Impact Outsourcing was founded in Nairobi in 2021, we decided that perimeter deserved a written standard. These are the five commitments it rests on.

Confidentiality is signed before data moves

A non-disclosure agreement is signed on day one, before a single sample changes hands. A partner that asks for your data first and the paperwork later has the order wrong.

Every person who touches data has a name

Anonymous crowds cannot be held to account. Training data should be handled by trained, full time people on a named team, with one delivery lead who answers for the work.

That is how our operation runs. No operator joins live work until they have completed at least three weeks of calibration on gold standard data.

Access is limited, and it ends

Only the people working on a project should be able to reach its data, inside controlled environments, and that access should end the moment their role does.

Our delivery floor in Westlands, Nairobi, is access controlled and built for this work, with redundant power and dual carrier fibre so it keeps running through outages.

Data protection law is the floor, not the ceiling

GDPR and Kenya’s Data Protection Act of 2019 set the minimum. A serious partner can tell you, in writing and before work starts, where your data will live, who will process it and under what agreement.

The work ends cleanly

When a project closes, the data should be deleted and the deletion confirmed in writing. If anything goes wrong along the way, the client should hear about it first, and fast.

Audited, not asserted

A standard only counts if someone outside the company checks it. Our information security program is certified to ISO 27001, certificate number 452AGI102121, and independently audited.

Security is not a feature a vendor adds when a client asks for it. It is a standard kept every day, or not at all. This is ours. Whoever you choose as a data partner, hold them to it.

Frequently asked questions

What does ISO 27001 certification mean for an annotation vendor?

It means the vendor runs an information security management system that has mapped its risks, set controls for each one and been checked by an independent auditor. It shows the controls exist and are followed. It does not mean risk is zero.

Why does a data annotation partner need strong security controls?

Annotators see the raw data a model learns from, often including sensitive images, text or personal information. That puts the vendor inside your security perimeter, so its controls matter as much as your own.

Does GDPR apply to data annotated in Kenya?

GDPR obligations travel with the data. A company bound by GDPR must make sure any vendor it uses, including one in Kenya, protects that data to the same standard. Kenya’s Data Protection Act of 2019 also applies to processing done in Kenya.

What should I ask an annotation vendor about data security?

Ask who will see your data and whether they are employees, where the data will be stored, how access is removed, how quickly incidents are reported, and how deletion is confirmed when the project ends.