Trust & security
Your records stay in your account.We work from the tasks.
Butterfly Tasks is built to run inside your own cloud account. Your records stay there, and Butterfly staff will have zero access to them. Personal data about your customers never leaves your account.
We never need
- Your raw records
- A sample, an export or an upload
- Standing access to your systems
- Anything that names a customer or a member of staff
Example 1 of 8A motor claimA disputed card paymentA patient referralA supplier contractA refund requestA benefits applicationAn IT access ticketA maintenance work orderA motor claim
Your record
A motor claim
- Policyholder
- Policy number
- Address
- Vehicle
- Claim notes
- Stays in your cloud
- Butterfly staff: zero access
What we work from
The task
Check a motor claim against the policy
- Read the claim and the policy wording
- Check the cover, the excess and the exclusions
- Approve, decline or refer
Right answer The decision, the amount and the reason
Synthetic cases made around it
- S-01£2,180 · rear bumperApprove
- S-02£6,900 · two vehiclesRefer
- S-03£540 · not coveredDecline
01 · The boundary
Every line that crosses,and how it is controlled.
Four lines could cross the edge of your cloud. The first, your raw records, never does. You control the other three.
- 1
Your raw records to Butterfly
Never neededButterfly Tasks will read your records where they are, inside your account, and a record never leaves it.
- 2
A support session to Butterfly support
You approveBreak-glass access is approved by you, time-boxed and logged.
- 3
Model calls to your model provider
Per modelA residency policy for every model, agreed before the first comparison: London by default, the EU by agreement, global routing by opt-in with a transfer note you sign.
- 4
Tasks for AI labs to AI labs (the data program)
Opt-inOpt-in, task by task, on a separate contract.
Your cloud
You are the controller
- Your records
- Butterfly, installed by you
- Tasks, synthetic cases, runs, results
It reads in place and never writes
Your raw records to Butterfly
The risk
An upload or an export would put your records in a vendor’s hands, outside your own controls.
The control
We never ask for one. Butterfly Tasks will read your records where they are, inside your account, and a record never leaves it.
02 · How it installs
On patterns your security teamalready approves.
Your security review comes first. Then the install will read your systems read-only, starting with the tables your data team already loads.
A container in your AWS account
In your own account, with no inbound access from us.
A Snowflake Native App
In your Snowflake account. We cannot query your data.
Databricks, classic compute
In your own cloud account, beside your data team’s tables.
For your security team: how each install connects
- A container in your AWS accountInstalled in your own account and calling your model provider over PrivateLink. No inbound access from us.
- A Snowflake Native AppIt installs in your Snowflake account; we cannot query your data, and any outbound call needs an integration you approve.
- Databricks, classic computeOn the classic compute plane, which runs in your own cloud account, beside the tables your data team already keeps.
- Microsoft 365Mail, Teams and SharePoint arrive through Microsoft’s Graph Data Connect into your own Azure storage, after your admin consents.
- No recording of your people’s desktopsWe never record your people’s own desktops or keystrokes. Walkthroughs happen on a practice desktop with synthetic cases, never real ones, and their replays stay in your account. Where you already run task mining, we read its outputs.
- Telemetry, publishedThe install reports usage, state and health to us, in a schema you can read. No business data travels with it.
03 · Residency
Where each modeldoes its thinking.
Where a prompt is processed depends on the model, not on where Butterfly runs. On Amazon Bedrock, model calls run in accounts AWS owns, and model providers have no access to them.45 So we agree a tier with you before the first comparison.
Tier A · UK-resident
Processing stays in the London Region.47
- A large frontier modelIn-Region, London
- A mid-size frontier model, the older releaseIn-Region, London
- Retention
- Set to none where the model allows it, and enforced across your organisation by policy.46
- Used for
- The default for UK clients, and for any step that reads your own records.
Other models run through Databricks or your own provider, on that provider’s terms, and join a comparison by agreement.
Where these facts come from
Source: AWS, Bedrock model card: a large frontier model, fetched 26 Oct 2026; the older mid-size release, fetched 26 Oct 2026; the newer mid-size release, fetched 26 Oct 2026; a widely used model from another maker, fetched 26 Oct 2026 47
Source: AWS, Bedrock data retention, fetched 26 Oct 2026 46
04 · GDPR-by-design
You stay the controller.We bring the paperwork.
The duty to assess is yours, so the documents are yours to sign. We write them for your deployment, ready on day one.
GDPR applies in full
You stay the controller, and every deployment comes with a written lawful basis and a DPIA for you to sign.
Tasks, not people
Results for groups of at least five people, never a named member of staff.
Tested in your account
Agents will be tested on held-back cases inside your account, never on an export or an upload sent to us.
AI says it is AI
Our AI interviewer, which writes each task down with its owner for them to check, says it is AI, and so does our films’ narration, as the EU AI Act asks from 2 August 2026.51
DPIA, ready to signYou sign
Written for your deployment, because combining sources is a DPIA trigger. The duty is the controller’s, so you sign it and own it.
Legitimate-interests assessmentYou sign
Written for your deployment, with the three-part test and a note on whether the new use is compatible with the old one.
Article 30 record entryYou sign
The processing record line for your register, filled in for this deployment.
Employee noticeYou sign
Plain words for your staff: what is read, why, for how long, and that tasks are measured, not people.
Works-council templatesAgreed together
Consultation before deployment, and before any source is connected. Where a works council has a say, it has it first.
Residency policyAgreed together
Which model runs where, agreed before the first comparison, with a transfer note for any global model.
Architecture and data flowsWe supply
The install, what it reads, the telemetry it sends (usage, state, health: no data), and the break-glass path you control.
Sub-processor listWe supply
Who processes what, for the product and for this website. The full list arrives with the pack.
You sign
DPIA, ready to sign
Written for your deployment, because combining sources is a DPIA trigger. The duty is the controller’s, so you sign it and own it.
05 · Sub-processors
Who processes what.
Inside your cloud, the list is yours. Outside it, this is everything that touches Butterfly’s side.
In your cloud
Yours, under your own contracts. Butterfly adds nothing to this list.
- Your cloud provider (for example AWS)Hosts the install, in your accountYour data, as today
- Your model provider (for example Amazon Bedrock)Processes model calls, in the residency you choosePrompts and completions
Butterfly’s own
What reaches us, and who helps us run this website.
- Butterfly’s control planeReceives telemetry from your installUsage, state and health; no business data
- Butterfly ResearchReads public, company-level pages for a web address you enterThe web address
- NetlifyHosts this website and stores form messagesWhat you type into a form
- ResendEmails form messages to our teamWhat you type into a form
- ElevenLabsVoices the films: in advance, and, where live narration is switched on, the sentences that carry a company’s nameA company’s name, where live narration is on; nothing you type into a form
06 · The security pack
Requestthe security pack.
Everything your security reviewers ask for, as documents they can file, sent by a person on our team.
- What arrivesThe pack as documents your reviewers can file, and a named person to answer their questionnaire.
- What we never ask forYour raw records, or a sample of them. Not now, not later.
- Security audits and contractsWhere each stands today, in writing, in the pack.
- Who you contract withQuetzals Labs Corporation, Panama.
Your proposal
Get your proposal.Then register your interest.
A readiness report made from your company’s public website: what your tasks cost, and the first 25 to test. If it reads right, register your interest: a person from Butterfly will call you to talk it through.
Or read on:Agent benchmarksHow it works