Your data stays in your account.
We build every system in a cloud account in your name, in the region you choose. BhuwanLabs keeps no copy of your data, and everything we build stays yours.
Architecture
Runs in an account you own
Every component (model calls, functions, storage, logs) is deployed into an AWS account in your name, in a US or Australian region you pick. If you don't have one, we set it up for you, and you hold the keys. Nothing runs on BhuwanLabs infrastructure.
Claude on Amazon Bedrock
Models are accessed through Amazon Bedrock under your AWS agreement. AWS states that Bedrock does not use your prompts or outputs to train models (AWS documentation).
Logs you keep
Conversations, outputs, changes and access are logged in your account, using write-once retention where the logs are business records.
Pinned and tested
Model versions are pinned, and every change is tested against real examples from your business before it goes live.
Phone calls and other services
A front desk system needs a phone provider to carry the call, and a content system posts through your social accounts. Those services run under accounts in your name and signed agreements, and callers are always told they are speaking with an automated assistant. Transcripts, recordings and records are stored in your account, and call recording follows the consent rules in your state. Before we build, you get a list of every service your system uses and what it sees.
How we access your systems
- Through a scoped, revocable role in your IAM Identity Center, with MFA, and every session logged in your CloudTrail.
- Deployment access by default, with no standing read access to your data stores. Development uses synthetic or de-identified data.
- If we ever need to see live data to fix something, your team grants emergency access for a set time, and every action is recorded.
- We work from Melbourne, Australia. Your data stays in the AWS region you choose, and every session we open is logged in your account, so where we sit does not change where your data is. If your policies restrict access from outside the US, we agree the access model with you in writing before any work starts.
Healthcare and HIPAA
Amazon Bedrock is on AWS's HIPAA Eligible Services list, so it can process PHI under your AWS Business Associate Agreement. Where a project involves PHI, we sign a BAA with you. HIPAA compliance depends on your overall program; there is no such thing as HIPAA-certified software.
Incidents and changes
- We tell you about any security incident affecting your systems within 24 hours of finding it.
- Advance notice of model retirements and provider term changes that affect your system.
- No use of your data to train any model, written into the contract.
If we are unavailable
Your system should never depend on any one person, including our founder. You own the accounts, the code, the setup and the instructions for running it. The contract includes a written handover plan, and everything is documented so another engineer can take over.
Due diligence
BhuwanLabs does not hold a SOC 2 report yet. AWS's own reports cover the infrastructure your system runs on. We complete your security questionnaire (SIG Lite, CAIQ-Lite or your own) and provide an architecture and data-flow diagram on request. Ask for them on your call.
Talk it through
Thirty minutes with Bhuwan Aryal, the engineer who would build it. You'll leave with a written plan, a fixed quote and an honest view on which system is worth it for you, if any.
Live in 2 to 4 weeks. Month to month after that, and you can cancel anytime.
Book a 30-minute callBhuwan Aryal
Founder, BhuwanLabs