How we handle your information.

We see nothing before an agreement is signed. No system access, no documents, no data. A mutual non-disclosure agreement is signed first, every time. We are glad to provide one or work from yours, and we offer it rather than waiting to be asked.

You own the AI account your system runs on. Every build runs on your own account with the AI provider, under your own key and your own contract with them. You are not relying on our description of how your data is handled. You hold that relationship directly and can read the terms yourself.

In production, in your environment. Finished systems are deployed single-tenant in your own cloud account, running on your own third-party accounts, including your AI provider and any data vendors. We do not retain a copy of your production data.

During the build, honestly described. Design and planning happen in our own environment. During development we work with real data where you provide it, because a system validated only against invented data is a system that fails on contact with the real thing. Where the work allows it we use scrubbed or sample inputs instead, and we will say which applies to your project before it starts.

Real information you share during a build is held in a single controlled development environment, under the agreement signed beforehand, and is removed when the build concludes. That environment runs full-disk encryption, requires authentication every time the device is left, keeps source code in private repositories, holds no credentials in readable form, and sits in the United States.

Any firm claiming it never sees client data is either not describing its process accurately or is not testing against reality. We would rather tell you exactly what happens and how it is protected.

What we ask for: least privilege. Access to the specific systems a project requires and nothing else, with individual credentials for each, read-only wherever the work allows it. We do not ask for blanket administrative access as a starting position.

You approve each person. Access is granted per engagement, to named individuals, and only after you have approved that person. Everyone with access to a client system is under a signed confidentiality agreement. Access is removed when someone comes off a project and when an engagement ends.

Third parties depend entirely on what is being built, so we do not publish a generic list that would be wrong for most engagements. You receive the complete list for your own project before work begins, and nothing is added later without telling you.

Because each system runs on your own AI provider account, your information is governed by your contract with that provider. Business API traffic is not used to train models by default, and you can verify that against the provider's own terms rather than taking ours.

We do not use consumer chat products for client work. No client information has ever been placed into one.

Private repositories only. Secrets are kept out of the codebase and scanned for. Dependencies are checked before anything reaches production, and every release goes through a security review against a written internal standard rather than a judgment made on the day. That standard is available for your security team to review under NDA.

Systems we build keep a record of what was submitted and what was returned, because in regulated work that record is frequently a requirement rather than a convenience. Those records live inside your environment, and retention is configured to your obligations, including multi-year requirements where they apply.

Where the work allows it we scope client personal information out of a system entirely, which is the cleanest answer to a great many compliance questions. Where a system genuinely has to handle it, that is agreed explicitly and in writing beforehand rather than discovered later.

Credentials and access are revoked immediately, not at the end of a notice period. Working copies of your data are returned or destroyed within thirty days of the engagement ending or of a written request, whichever comes first. A continuing maintenance arrangement is an ongoing engagement, so nothing is removed while it runs.

At handover you receive a documentation package written so that a competent developer other than us can operate the system. If you ever want to move to another provider, we will help you do it.

If we become aware of an incident affecting your information, we will tell you within 48 hours. We will tell you what we know at that point rather than waiting until we know everything, and we will support your own investigation, notifications, and any regulatory reporting.