Security and IP
You are trusting a small studio with your data and your code. This page says exactly what we do with both, so you can check it before the first call.
- NDASigned before the first call
- Code and IPYours, in writing
- Your dataLeast access, deleted at handover
- Your NDA received
- Signed and sent back
- Consult: 30 minutes, no slides
Your code and IP
Everything we write for you is yours. The contract assigns the code, the documents and the eval sets to you.
- CodeIn your repository from the first commit
- DocumentsSpecs, architecture, reports
- Eval setsYour questions and answers
- ReuseNever on another client's project
Your data during a project
The least access the work needs, for the shortest time.
- Least access
Read-only wherever the work allows, scoped to the data the project needs.
- Where it lives
In your cloud account, or a sandbox we set up for the project, in the region you choose.
- Personal accounts
Every person has their own account with two-factor sign-in. No shared logins.
- Secrets
Keys and tokens stay in your secret store, never in code or chat.
- Deleted
Our copies of your data are deleted at handover, and we confirm it in writing.
AI models and your data
Which provider sees your data is your decision, made before the build starts.
- ProvidersDirect, through your cloud, or self-hosted
- TrainingBusiness API terms that exclude training on your data
- RegionYour choice, where the provider offers it
- LoggingEvery request recorded for audit
At handover
When the project ends, our access ends. You get a written list of every change to access, keys and data.
- AccountsOurs removed
- KeysRotated
- Data copiesDeleted, confirmed in writing
- Our accounts removed from your systems
- Keys and tokens rotated
- Our copies of your data deleted
- Admin rights moved to your team
Questions from security reviews
We answer your vendor questionnaire as part of the sprint set-up.
Are you SOC 2 or ISO 27001 certified?
No. We are a small studio, so we work inside your controls instead: your cloud, your accounts, your policies, and your vendor review.
Will you sign our DPA?
Yes, when your data includes personal data. We read it before the sprint starts, not after.
Who else can see our data?
Only the people named on the project. You meet every collaborator before they get access.
Can the whole project stay inside our cloud?
Yes. Code, data, models and logs can all run in your account, so nothing leaves it.