Contact us

Privacy Policy

Privacy Policy

Effective Date: October 2026
Version: 2.2

Aligned Sovereign Intelligence Institute (“Aligned Institute”, “ALI”, “we”, “us”, or “our”), a division of De Monroy Group LLC, is committed to safeguarding your privacy and protecting the proprietary integrity of your artificial intelligence architectures. This Privacy Policy explains how we collect, use, disclose, and protect your information when you visit our website aligned-institute.com (and asiinst.com), submit an application for AI Technical Due Diligence (TDD) or Fast-Audit, use the ALI Signals Platform, participate in the ASIP research grant platform, or interact with our blockchain protocol services (including ABC, AIC, and SAT tokens on Base Protocol).

Your use of our Services is also governed by our Terms of Service v1.3, which sets forth the operational terms for TDD evaluations, testing scopes, non-destructive warranties, testnet limits, and compliance obligations. In the event of a conflict between this Privacy Policy and the Terms of Service regarding legal rights or operational conduct, the Terms of Service prevail.

1. Global Scope

This policy applies to users, clients, and counterparties globally. By accessing our Services, you acknowledge that your personal and technical information may be processed in jurisdictions with different data protection laws than your home country. We comply with applicable international data protection frameworks, including:

  • GDPR — for users and enterprise counterparties in the European Economic Area (EEA), where our centralized services and audit operations process personal and corporate data
  • Swiss Federal Act on Data Protection (FADP) — our targeted jurisdiction for Phase 2 domicile (2027–2028)
  • CCPA / CPRA — for California residents and commercial entities
  • Texas privacy and consumer protection laws — during Phase 1 United States operations

Data Controller: Aligned Sovereign Intelligence Institute / De Monroy Group LLC, domiciled in Austin, Texas, USA (Phase 1). Contact: [email protected]. A designated Swiss data protection representative will be published upon Swiss entity formation.

Children: Our Services are strictly enterprise and research-oriented, and are not directed to persons under 18 years of age. We do not knowingly collect personal information from minors.

2. Information We Collect

2.1 Personal & Corporate Information — Collected by Service Stage

We collect information depending on how you engage with ALI across our technical due diligence, SaaS, research grant, and protocol services:

Stage / ServiceWhoData CollectedWhen / Purpose
AI Technical Due Diligence (TDD) & Fast-AuditSubmitting startups, venture allocators, M&A buyersCompany name, authorized representative name and title, corporate email, billing address, target staging URL/endpoint, test API credentials, system prompts, guardrail instructions, architecture documentationAt audit intake; used exclusively to execute non-destructive adversarial stress testing, compute unit economics modeling, and deliver the Five-Pillar Diligence Scorecard
Payment & BillingTDD clients and SaaS subscribersPayment card details (cardholder name, card number, expiration, CVC), transaction history, and invoice recordsProcessed directly by our PCI-DSS compliant payment processor (Stripe). ALI does not store raw credit card numbers on its servers
Testnet RegistrationResearch grant participantsName, institutional affiliation, email address, wallet address, submission metadataFirst testnet grant submission or researcher registration
Full KYC / AMLGrant recipients prior to disbursementGovernment-issued photo identification, proof of address, date of birth, nationality, sanctions screening outcomes, wallet ownership attestationBefore first grant disbursement exceeding applicable regulatory thresholds (targeted at CHF 15,000 / USD 1,000 equivalent)
Accredited Investor KYCAIC token subscribers & institutional co-leadsFull legal identity verification, accredited investor status documentation, source of funds declarations, AML screeningPrior to SAFT execution or membership unit issuance
Signals PlatformSaaS subscribers and enterprise analystsAccount credentials, billing information, usage metrics, organizational contact detailsAt product onboarding
General InquiriesAny website visitor or partnerName, email address, message bodyWhen you contact support, request a demo, or request audit access

2.2 Target AI Application Telemetry & Zero-Training Guarantee

During the execution of an AI Technical Due Diligence (TDD) or Fast-Audit engagement, ALI systems interact with the client’s submitted endpoints to conduct automated stress testing, adversarial prompt injection fuzzing, recursive boundary tests, and telemetry profiling.

STRICT ZERO-TRAINING COMMITMENT: Under no circumstances will any client prompts, system instructions, architecture specifications, API responses, generated outputs, or test telemetry ever be used to train, retrain, fine-tune, or calibrate public, commercial, or foundation artificial intelligence models. Your proprietary weights, prompts, and internal reasoning remain exclusively yours.

TELEMETRY PURGE SCHEDULE: All volatile testing data, raw HTTP request and response logs, staging API keys, and injection test payloads are permanently erased and purged from ALI testing infrastructure within fourteen (14) business days following delivery of the final audit report.

2.3 Blockchain and Protocol Data

Transactions on Base Protocol (Layer 2)—including Base Sepolia testnet—are public and irreversible. When you interact with ASIP smart contracts or tokens (ABC, AIC, SAT):

  • Your wallet address, transaction history, voting records, Authority Score, and token balances are permanently recorded on the public blockchain.
  • This data is globally accessible and cannot be modified or deleted by ALI.
  • We do not control the underlying blockchain networks. We cannot alter, hide, or delete your on-chain activity.

Testnet participation records—including Authority Score accruals and grant submission metadata—do not create monetary entitlements or legally binding claims against ALI. See Terms of Service v1.3 §4. Mainnet activation may cryptographically anchor testnet verification events via published Merkle commitments.

2.4 Automated Technical Data & Web Analytics

When you browse our websites or use our web applications, we may automatically collect:

  • IP addresses, browser type, operating system, and device identifiers (for security monitoring, fraud prevention, and rate-limiting)
  • Session cookies and performance tokens (strictly necessary for authentication and session management)
  • API logs and error telemetry (for infrastructure stability and diagnostic optimization)
  • Chain analytics and wallet risk indicators (sanctions screening and anti-fraud verification)

3. How We Use Your Information

We process your information strictly for legitimate commercial, diligence, and compliance purposes:

  • Perform Technical Due Diligence & Fast-Audits: Assessing target AI architectures against the Five-Pillar Diligence Scorecard, detecting prompt vulnerabilities, calculating compute unit economics, evaluating EU AI Act conformity, and generating confidential Executive Verdict Scorecards.
  • Issue Cryptographic Verification Records: Registering audit status, Audit ID, and SHA-256 verification hashes on the public verification portal (https://aligned-institute.com/verify). Full audit reports remain confidential.
  • Process Commercial Transactions: Collecting audit fees, processing payments through Stripe, administering the 100% Series A Diligence Credit, and managing enterprise subscriptions.
  • Operate the Research Grant Ecosystem: Evaluating grant proposals, verifying milestone completion via verifySubmission(), and calculating Authority Scores.
  • Ensure Security & Legal Compliance: Conducting automated sanctions screening against OFAC, EU, UK, and UN lists, preventing Sybil attacks, and meeting KYC/AML obligations.
  • Communicate With You: Delivering audit reports, responding to inquiries, providing SLA updates, and sending critical security notices.

4. KYC/AML and Regulatory Compliance

ALI maintains robust compliance standards across its grant disbursement and institutional engagement operations:

  • FATF Alignment: We voluntarily align grant disbursement protocols with Financial Action Task Force (FATF) Recommendation 15 guidance. ALI is not a registered Virtual Asset Service Provider (VASP) in Phase 1.
  • Sanctions Screening: All client entities, wallet addresses, and grant recipients are systematically screened against OFAC, EU, UK, and UN consolidated sanctions lists prior to transaction execution.
  • Travel Rule Compliance: For disbursements and transfers exceeding applicable thresholds (USD 1,000 / CHF 1,000 equivalent), we collect and retain required originator and beneficiary data.
  • Anti-Fraud & Sybil Detection: We analyze account clustering, wallet relationships, and submission telemetry to prevent fraudulent grant exploitation.

5. Disclosure of Your Information

We share your information only with trusted service providers under strict data protection and confidentiality agreements:

  • Payment Processors: Stripe, Inc., for secure credit card processing, fraud prevention, and invoicing under PCI-DSS Level 1 certification.
  • Cloud Infrastructure Providers: Secure hosting and database infrastructure (including DigitalOcean, AWS, and GCP) operating under comprehensive Data Processing Agreements (DPAs) with encryption in transit and at rest.
  • Identity & Sanctions Screening Vendors: Third-party verification platforms executing KYC checks and sanctions list matching.
  • Verification Portal (Public Metadata Only): The public verification registry publishes only the Audit ID, Project/Organization Name, Issue Date, Verdict Status, and cryptographic SHA-256 fingerprint. No proprietary prompts, test payloads, or detailed score breakdowns are published publicly.
  • Legal & Regulatory Authorities: Where compelled by valid subpoena, court order, or applicable law.
  • Corporate Transactions: In connection with a corporate reorganization, merger, or the establishment of our Swiss Phase 2 foundation, subject to equivalent privacy protections.

We do not sell personal data, corporate source code, or audit telemetry to any third parties.

6. Data Retention and Storage

We adhere to strict data minimization and purposeful retention schedules:

  • TDD Testing Telemetry: Raw test requests, adversarial inputs, execution logs, and staging credentials are permanently purged within fourteen (14) business days following delivery of the final audit report.
  • Final TDD Reports & Verification Hashes: Retained for five (5) years to support client verification, audit trail validation, and Series A credit redemptions.
  • KYC/AML Records: Retained for a minimum of five (5) years following the conclusion of the relationship, in compliance with standard AML record-keeping obligations.
  • Signals Platform & Customer Billing Data: Retained for the subscription term plus two (2) years for tax and accounting compliance.
  • Public Blockchain Data: Permanent and immutable on Base Protocol.

Storage Location: During Phase 1, data is stored securely on servers located in the United States. Following Swiss entity formation and FINMA authorization (targeted 2027–2028), data processing policies will be updated to describe Swiss data localization and Standard Contractual Clauses (SCCs) for cross-border data transfers.

7. Security of Your Information

We employ enterprise-grade technical and administrative security measures, including end-to-end TLS encryption, AES-256 rest encryption, rigorous role-based access control (RBAC), and continuous vulnerability monitoring. However, no internet transmission is 100% secure, and non-custodial blockchain transactions remain subject to the security of your own private keys.

8. Your Data Rights

Under applicable data privacy regulations (GDPR, Swiss FADP, CCPA/CPRA, Texas Data Privacy and Security Act), you have the right to access, rectify, restrict processing of, or request deletion of your personal data held in our centralized systems. You may also request data portability or lodge a complaint with your competent supervisory authority.

Deletion requests cannot erase public blockchain transactions on Base Protocol due to cryptographic immutability. To exercise any of your data rights or request early purge of your audit file, contact us at: [email protected].

9. International Data Transfers

As a globally operating institute, data may be transferred to and processed in the United States and other international jurisdictions. Where required by GDPR or Swiss FADP, we implement approved Standard Contractual Clauses (SCCs) and technical transfer safeguards.

10. Changes to This Policy

We may update this Privacy Policy periodically. Material modifications will be posted to this page with an updated Effective Date and communicated to active clients and registered users where practicable.

11. Contact Us

If you have questions regarding this Privacy Policy, our Zero-Training Warranty, or our technical data handling practices, please contact:
[email protected]

Document: ASII Privacy Policy v2.2 | Status: Effective — Incorporating AI Technical Due Diligence (TDD) Data Governance, Zero-Training Warranty & Telemetry Purge Schedule | Supersedes: Privacy-v2.1 (May 2026) | Companion document: TCs-v1.3 (Terms of Service) | Next review: Upon Swiss domicile confirmation