Approved tools and permissions
Customer-owned accounts, explicit permissions, limited-duration access, and human escalation for consequential actions.
04 · Security
Control is
the product.
CHUMOS starts from boundaries, approvals, and named responsibility. It is not a guarantee against every risk, and it is not a cybersecurity provider. CHUMOS coordinates with your existing IT or security provider where appropriate.
Responsibility map
Who owns what.
Named actors, explicit responsibilities, and clear exclusions.
Customer owns
- All business accounts and platform licenses
- Data and decisions about what enters AI tools
- Final approval of every consequential action
CHUMOS owns
- The documented configuration and its approvals
- Access limited to the permissions and duration needed for documented work
- Review, coaching, and bounded support within the agreed scope
IT / security provider owns
- Core infrastructure, identity, and security operations the customer already relies on
Excluded
- Credentials through public forms
- Unsupported regulated-data handling
- 24/7 monitoring and cybersecurity incident response
- Guaranteed ROI, error elimination, or compliance certification
Operating controls
A boundary you can name.
The exact implementation depends on the agreed platform and scope. The operating pattern does not.
What never enters by default
No credentials in public forms. No unsupported regulated data. No claim of controls CHUMOS has not actually put into operation.
Offboarding is part of setup
Access removal and responsibility transfer are documented before the engagement is treated as complete.
Claims stay scoped
Logging depends on vendor capabilities and agreed scope. Public security statements retain an owner, evidence, scope, and review date.
Security-first means transparent controls and responsibility—not a guarantee against every error, threat, or compliance obligation.