Security
How we handledata and code.
Access to production data, the outside services we use, generative AI, copies after delivery and certifications, in one place.
Principles
- We only list what we actually do today.
- If we don't hold a certification, we say so.
- For security, details such as vendor names, regions and tool settings stay off this public page.
Production data: our defaults
- Production runs in your cloud account, in the region you choose.
- You give us accounts with least privilege and two-factor sign-in, and they are deleted at handover.
- We build and test with synthetic data, not real data.
- Work that touches production data is done under a processing agreement signed with you.
Outside services
We use outside services such as cloud hosting, a cloud database and AI providers.
Ask us and we will send the names and regions of our processors and sub-processors in writing.
Generative AI and AI-assisted code
We use AI coding tools, and a person reviews and tests everything they produce. Your data and secrets never go into a prompt. Ask us and we will send the details of the tools, plans and settings in writing.
- Deliverables include an open-source license report and a software bill of materials (SBOM).
- Defect fixes (for a fixed-scope build, the defect warranty) apply to AI-assisted code exactly as to any other code.
Copies after delivery
How long we keep copies of the code we deliver and of the files you share with us is agreed with you before signing and written into the contract. Unless the contract says otherwise, we delete our copies whenever you ask and confirm it in writing.
Certifications
ISO 27001, SOC 2: not held
Security questionnaires
We answer your security questionnaire or checklist in writing. Requests come in through the contact form.
- We read it and reply with questions or call times.
- A free 30-minute video call, NDA first if you'd like.
- A written proposal and estimate, with scope, cost and schedule spelled out.