Security, data & agreements

The short version

A desk does one written internal job through approved accounts you can revoke. It never contacts customers or moves money, even if someone approves. Other restricted actions require review; approval does not expand the signed scope.

Puestario does not hold ISO 27001 certification or a SOC 2 report. We provide the scope, access rules, and agreement templates to support your supplier review. Your company decides what additional checks it needs.

What the desk can never do

• Talk to your customers. It is internal only. It can write a draft; a person sends it.
• Move money. It can read a payment record. It cannot pay, charge, or refund anyone.
• Change access or permissions. It brings the exact change back to the owner and waits.
• Delete or sign anything on its own.
• Work outside the one job written on the Job Card.

These are set in the software, not only written here. The Job Card names the job, the systems it may touch, and the list of things it may never do, and you sign it before anything is installed.

Your business software accounts

• A named service account for the desk. Never a person's login, and never a shared one.
• Read only wherever the job allows it.
• Scoped to the systems written on the Job Card, and nothing else.
• Created by you, owned by you, and revocable by you in seconds without calling us.

If your systems use single sign on, the desk's account lives inside it like any other account, so switching it off is the same action you already take when someone leaves the company.

Where the machine sits

The desk is a dedicated machine in your office, on your premises, under your physical control. It is not a server we run somewhere else, and nobody's personal computer is involved. If you unplug it, it stops.

Because it is a separate machine, it sits outside your single sign on. We treat that as the thing to control rather than the thing to gloss over. The accounts it uses inside each of your systems are still yours and still revocable there, which is where the real gate is.

Who at Puestario can reach it

• Named people only. Access is by named individual, never a shared login.
• Remote access is off by default and turned on for a session, not left running.
• Every session is logged, and you can ask for that log at any time.
• You can revoke our access yourself, at any moment, without notice and without giving a reason.
• When someone joins or leaves Puestario, you are told, and their access is removed the same day.

Puestario is two people today. We are writing this down now, while it is two, so that it still holds when it is five.

Where your information goes

The job runs on a dedicated machine, but the service is not entirely local. Approved task information may pass through the AI provider, connected business software, messaging services, and any agreed backups or support tools. The written setup must identify each service, the data it receives, access, and retention before installation.

We use task data to provide the agreed service. The written data schedule identifies any working files, logs, backups and support access, their purpose and their retention.

Nothing about your company appears on our public live board. That board shows Puestario's own desks and only ever will.

The AI provider

New managed installations use Puestario’s approved OpenAI API setup, with ZDR enabled for eligible use and an executed BAA for covered API services. The written setup identifies the exact provider, features and data handling. Existing installations keep their documented setup until a migration is agreed.

You own and control the accounts in your business software. Puestario manages the OpenAI API account for this service; it does not transfer to you when the service ends. We document the permitted API use and access limits before installation.

What we will sign

• A non disclosure agreement. Always, and we offer it rather than wait to be asked.
• A written scope, which is the Job Card, naming the job, the systems, and the forbidden list.
• Your own vendor or supplier agreement, if you have one. We would rather sign yours than argue for ours.
• A data handling and access addendum covering scope, excluded data, named accounts, our access rules, approved providers, a seventy-two hour incident notice, and your right to check.

The confidentiality and data-handling templates are below. We prepare the service agreement with you after the initial call.

Clients who compete with each other

We work in a small area and a small number of industries, so two of our clients may well be competitors. That is a fair thing to ask about.

• One desk's files and context are never read by another desk. Each desk is a separate machine with separate accounts.
• We do not reuse a client's documents, prices, customers, or process as an example anywhere, including in a sales conversation.
• If you want it in writing that we will not install for a named competitor, ask, and it goes in the agreement.

If your company is certified

If you hold ISO 27001 or SOC 2, you are the one who has to justify a new supplier to an auditor. What we can hand you:

• A written scope naming the exact systems and the exact data the desk touches
• A named service account, read only wherever the job allows
• The provider and service list for your setup, with the available supporting documents
• A written scope with clear responsibilities and service dates
• Written answers to your supplier questionnaire

For a certified client we do not use browser automation with stored human credentials. If one of your systems has no API, we tell you so and we do not build that bridge for you.

We provide the agreed scope, access rules and supporting documents for your supplier review. Our provider arrangements and program membership do not certify Puestario.

When it ends

When the service ends under the signed agreement:

• You revoke the accounts. You do not need us in order to do that.
• Your agreed files, skills, configuration, and work remain yours. Equipment ownership, documentation, and handover responsibilities are recorded in your agreement.
• Our access ends the day you say it ends.

Telling us about a problem

Report a security concern by phone or email using the contact details below. Do not put private records, patient information or passwords in the callback form. We answer the same business day. If we learn of an incident affecting your desk or data, we notify you within seventy-two hours in writing with what we know so far.

1. Mutual Non-Disclosure Agreement

Signed first, before the scan, before we see anything. We offer it; you do not have to ask.

This Mutual Non-Disclosure Agreement is between PUESTARIO LLC, a Florida limited liability company with its principal place of business at [ADDRESS] (Puestario), and [CLIENT LEGAL NAME], with its principal place of business at [CLIENT ADDRESS] (the Company), effective [DATE].

1. What is confidential

Confidential Information means anything one side shares with the other that a reasonable person would treat as private: customer lists, prices, margins, suppliers, processes, financial records, staff information, system credentials, and the contents of any system a desk is connected to. It includes information shared before this agreement was signed. For the Company it also includes the fact that a desk is being evaluated or installed, if the Company asks that this be kept private.

2. What is not confidential

• Information that is already public through no fault of the receiving side.
• Information the receiving side already had, and can show it had, before it was shared.
• Information a third party gave to the receiving side with the right to do so.
• Information the receiving side developed on its own without using the other side's information.

3. What each side promises

• To use the other side's Confidential Information only to evaluate, build, install, and run the desk, and for nothing else.
• To share it only with its own people who need it for that purpose and who are bound by obligations at least this strict.
• To protect it with at least the care it uses for its own private information, and never less than reasonable care.
• To tell the other side promptly, and in any case within seventy-two hours, if it learns the information was accessed or disclosed in a way this agreement does not allow.
• Not to reverse engineer, copy, or reuse the other side's information as an example, a demonstration, a template, or a sales aid, in any form, for anyone.

4. Competing clients

Puestario works in a small area and a small number of industries, and the Company may compete with another Puestario client. Puestario promises that no Confidential Information from the Company is ever placed on, read by, or made available to a desk belonging to anyone else, and that nothing about the Company's business is used to inform work for a competitor. Each desk is a separate machine with separate accounts. If the Company wants Puestario to agree not to install for a named competitor, that is added to the Service Agreement.

5. If the law requires disclosure

If a court or a government agency requires either side to disclose Confidential Information, that side will, where the law allows, tell the other side first so it can object, and will disclose only what is required.

6. Returning it

When the relationship ends, or earlier on request, each side returns or destroys the other side's Confidential Information and confirms in writing that it has done so. Ordinary backups that cannot practically be purged remain protected by this agreement until they expire.

7. How long this lasts

These obligations last for five years after the relationship ends. For system credentials, personal information, and anything the law protects for longer, they last as long as the law requires.

8. The rest

This agreement is governed by the laws of the State of Florida, and any dispute is heard in the courts of Miami-Dade County. Either side may seek an injunction to stop a breach, because money alone may not fix one. This agreement does not oblige either side to do business with the other, and it does not give either side any rights in the other side's information beyond what is written here. It can only be changed in a writing signed by both sides.

Signed for Puestario: [NAME, TITLE, DATE]. Signed for the Company: [NAME, TITLE, DATE].

2. Data Handling and Access Addendum (Schedule B)

Written for the person who has to approve a new supplier. It is the security page, turned into a promise.

This addendum is part of the Desk Service Agreement between PUESTARIO LLC (Puestario) and [CLIENT LEGAL NAME] (the Company). It describes what data the desk touches, how access is granted and controlled, who processes what, and what happens when something goes wrong. Where the Company is subject to a law or standard that requires a written contract with its service providers, this addendum is intended to be that contract.

1. Scope of data

The desk touches only the systems and the data named on the Job Card, and only for the job named there. The Job Card lists each system, whether the desk's access is read-only or write, and which fields it may write to. Anything not on the Job Card is out of scope, and Puestario does not build access to it.

2. Data the desk is built to avoid

• Full payment card numbers and card security codes. If a system holds them, the desk is scoped to fields that do not, so the desk stays outside the Company's card-data environment.
• Social Security numbers, bank account numbers, and government identification numbers, unless the Job Card names them explicitly and the Company's compliance owner has approved it in writing.
• Health information of any kind, unless a separate written agreement covers it.
• Anything the Company marks as excluded on the Job Card.

3. Accounts and access

• The Company creates a named service account for the desk in each system on the Job Card. The desk never uses a person's login, and never a shared one.
• Each account is read-only wherever the job allows, and scoped to the systems and fields on the Job Card.
• The Company owns its business software accounts and may revoke them at any time without notice to Puestario. Puestario explains this at installation. Puestario’s managed API account is separate and follows section 4 of the Service Agreement.
• Where the Company uses single sign-on, the desk's accounts live inside it and are turned off the same way as any departing employee's.
• For a Company that holds a security certification, Puestario does not use browser automation with stored human credentials. If a system on the Job Card has no API, Puestario says so and does not build that bridge.

4. Where the work happens

The desk is a dedicated machine on the Company’s premises in Florida, under its physical control. The Company’s systems remain the source of record; the machine holds agreed working files and records. Approved external processing is documented in section 6. Puestario does not keep Company business data for its own use or move Company records outside the United States. The parties must verify that the chosen services and configurations meet this location commitment before connecting them; an on-site machine alone does not establish data residency. Support access follows section 5.

5. Puestario's access to the machine

• Access is by named individual only. Puestario keeps a list of the individuals who may access the Company's desk and gives it to the Company, and updates it before any change.
• Remote access is off by default. It is turned on for a specific session, for a stated reason, and turned off when the session ends. It is never left running.
• Every session is logged: date, individual, reason, duration. The Company may ask for the log at any time and receives it within five business days.
• The Company may revoke Puestario's access at any moment, without notice and without giving a reason, and is shown how at install.
• When a person joins or leaves Puestario, the Company is told in writing and that person's access is removed the same day.
• Puestario's people are bound by written confidentiality obligations at least as strict as the NDA, and have been screened with at least a background check before being given access to any client desk.

6. AI provider and connected services

New managed installations use Puestario’s approved OpenAI API setup. Before access, the written setup must list each provider, enabled feature and connected service, the data shared, purpose, access, retention and any location restrictions. ZDR and BAA coverage must be checked separately for the actual services used. These arrangements do not cover every feature or third-party service. Protected health information requires a separate agreed scope and the necessary agreements before processing. Existing installations retain their documented provider until a migration is agreed. Puestario will not change the approved AI provider without thirty days’ written notice, and the Company may end the agreement without penalty if it objects. Additional services require written agreement before task data is shared.

7. Security measures Puestario maintains

• Full-disk encryption on the desk machine, with the key held in the machine's secure enclave.
• Multi-factor authentication on every Puestario account that can reach a client desk.
• Automatic security updates on the machine's operating system.
• Credentials stored in the machine's keychain, never in a plain file, a script, a message, or a document.
• No client credentials stored on Puestario's own machines or accounts.
• A written joiner and leaver process, applied the same day.
• A review of the desk's access every ninety days, with the Company, as part of the scheduled check-in.

8. If something goes wrong

If Puestario learns that the Company's data was accessed, disclosed, altered, or lost in a way the Job Card does not allow, or that the desk or Puestario's access to it was compromised, Puestario tells the Company within seventy-two hours of learning it, in writing, with what is known so far. Puestario then cooperates fully with the Company's own investigation and any notice the Company is required to give under the Florida Information Protection Act or any other law, and does not notify anyone else on the Company's behalf without the Company's instruction, unless the law requires Puestario to.

9. The Company's right to check

Once a year, or after an incident, the Company may ask Puestario to answer a written security questionnaire, provide its access log for the Company's desk, and walk through the desk's configuration on-site. Puestario responds within fifteen business days. If the Company's own regulator, auditor, or certifying body requires more, the sides agree the scope in writing first.

10. Industry-specific terms

• Accounting and tax firms subject to the FTC Safeguards Rule: this addendum is intended to serve as the written contract with a service provider that the Rule requires, and Puestario will cooperate with the Company's Qualified Individual and its written information security program.
• Licensed customs brokers subject to 19 CFR Part 111: the Company's signature on this addendum is its written authorization for Puestario to access the client records named on the Job Card, and Puestario keeps those records within the United States and treats them as confidential under the Company's obligations.
• Any Company holding ISO 27001 or SOC 2: Puestario provides the written scope, the named accounts, the subprocessor list, the service start and end dates, and written questionnaire answers, so the Company can place Puestario in its supplier register with the evidence its auditor expects.

11. Return and deletion

When the agreement ends, the Company revokes the desk's accounts. If the machine remains Puestario's property, Puestario collects it within ten business days and, in the Company's presence if the Company wishes, securely erases it and confirms erasure in writing. A client-owned machine remains with the Company; managed access is removed without erasing client-owned work. The Company receives a copy of the desk's context folders, rules, and work records before erasure, in a standard format.

12. Puestario is not certified

Puestario does not hold ISO 27001, SOC 2, or any other certification and does not claim to. The promises in this addendum are Puestario's own, made by a small company that keeps its scope small on purpose. They are enforceable as written.

Signed for Puestario: [NAME, TITLE, DATE]. Signed for the Company: [NAME, TITLE, DATE].