Security & compliance
Security and compliance built into how we work
Your code, accounts and data stay under your control from day one. We sign your NDA before the first call, work in your repositories and cloud accounts with least-privilege access, and design data handling to support GDPR and your industry’s requirements.
Security & compliance
Confidentiality
- NDA first. We sign your NDA — or provide ours — before you share any details.
- Client names stay confidential. Our case studies describe the systems we built without client names.
- US and EU paperwork. Contracts, intellectual property assignment and data processing terms as your company requires.
Ownership and access
- Repositories, cloud accounts, domains and data are created in your name from the first commit.
- Intellectual property is assigned to you; source code is in your repository throughout the project.
- Least-privilege access for our engineers, granted by you and revoked at the end of the engagement.
- Secrets and API keys are stored in your environment, never in the code.
Secure engineering practices
- Code review for every change and a separate staging environment.
- Role-based access control and audit-friendly data models in the systems we build.
- Encryption in transit (HTTPS/TLS) and the encryption options of your cloud provider at rest.
- Backups, logging and monitoring set up as part of the first release.
- Dependencies kept up to date during development and support.
Privacy and GDPR-ready data handling
- Data minimisation: we collect and store only what the process needs.
- Hosting region chosen by you — for example, EU regions for European personal data.
- Support for data export and deletion requests built into the system where personal data is stored.
- A data processing agreement on request.
AI and your data
API keys, logs and data stay in your accounts. We use providers’ business APIs, which by their published terms do not train on API data by default, and can use open models on your own infrastructure when data must not leave it. See AI integration.
Related: how we work · technology stack · contact.
FAQ
Questions we are asked most
Will you sign our NDA?
Yes, before the first call. We can also provide our own mutual NDA.
Who owns the code?
You do. Repositories, cloud accounts and data are created in your name from the first commit and intellectual property is assigned to you.
Can our data stay in the EU?
Yes. The system is hosted in your cloud account in the region you choose.
Contact
Talk to the people who will build it
Describe what you need in two minutes. We reply within one business day and send a written scope and timeline after a short call.
Company
Services