Security and trust

Security you can review

Your IT and procurement teams will have questions before they sign. Here are our answers, and we'll fill in your questionnaire too.

Code and accounts

Who owns the code?: You do. Your code and accounts stay yours. Ask for any of it at any time and we hand it over.
Where does our code live?: In your repositories, or in ours with full access for you.
Can it run in our own cloud?: Yes. Your product can run in your own cloud accounts, deployed to your standards.

Who can access our code?: Each person on your project has their own access, never a shared login, with two-factor sign-in on code, cloud and admin accounts. Everyone gets only the access they need.
What happens when someone leaves the project?: Their access is removed.
Is our project kept confidential?: Yes. Everyone who works on your project is bound to keep it confidential, and we never show client work publicly without permission.

Where does our data live?: We'll tell you exactly where your data is stored, and deploy in the region your rules require.
What data do you use?: Only the data a project needs, and we keep sensitive data apart from everything else.

Where do you host?: In your own cloud, to your standards, or on established providers.
Is it encrypted, backed up and monitored?: Yes. Encrypted connections, daily backups and monitoring on everything we host.
Can a release be undone?: Yes. A release can be rolled back in one step.

What goes into every product you build?: From the first release:
Two-factor sign-in for staff and admins
Clear rules on who can see and do what, tested before every release
Protection against password guessing and spam on public forms
A record of admin actions that can't be quietly changed
Third-party code checked for known security flaws before it ships
Do you review the code for security?: Yes. We run security reviews of the code, and track every finding until it's fixed.

Do you use AI tools on our code?: We use AI coding tools to move faster, always under senior review and the same tests and checks as any other code.
Are they trained on our code?: No. They're never trained on your code.
What if our policy says no AI?: Then we work without them. We work to your AI policy.
What about AI features in our product?: They use your data only for your product.

How do you handle an incident?: If we find or suspect a security incident that affects you, we tell you promptly, with what happened, what we've done and what comes next.
Can our own penetration testers test it?: Yes. We'll work with them, and fix what they find.

Will you sign our NDA and DPA?: Yes. We sign NDAs before discovery when you ask, and we sign data processing agreements.
What do we sign to start?: A master services agreement, with a statement of work for each phase, or your paper if you prefer.