Security
How we handle your code, access, and data
You are trusting us with your business processes and sometimes your customers' information. Here is what we do, in plain terms, and what we do not claim.
Our commitments
How we handle your data
Code ownership
Ownership of the code we write for you transfers to you on final payment. We use mainstream technologies and provide handover documentation so you can run and maintain the project without us.
NDA on request
We are happy to sign a non-disclosure agreement before you share details about your business or idea. Just ask at the start of the conversation.
Access control
We limit access to your code, servers, and data to the people working on your project, and we give each person only the access their role requires. When someone leaves a project, their access is removed.
Encrypted credentials
Passwords, API keys, and other secrets are stored in encrypted configuration or a secrets manager, not in the code repository and not shared in plain text over chat or email.
Backups
For projects we host or set up, we configure backups of databases and important files and explain how restoring works. The schedule and retention are agreed for each project.
Client data handling
We use your data only to do the work you hired us for. We prefer test or sample data in development where possible, and we limit use of production data to what the task requires. We do not sell your data.
Hosting in accounts you control
Wherever practical, we set up hosting and third-party services in accounts that belong to your business, so you are never dependent on us to access your own systems.
Safer AI usage
When a project uses AI model APIs, we review the provider's current data terms with you, avoid sending more data than needed, and keep a person in the loop for important decisions.
Honest note
What we do not claim
We do not currently hold formal security certifications or audit attestations, and we will not suggest otherwise. If your industry requires specific compliance, such as for health or financial data, we will discuss the requirements with you and your advisors up front and tell you honestly whether we can meet them for your project.
Your side
What we ask of you
- Use strong, unique passwords and multi-factor authentication on the accounts you own
- Tell us promptly if someone with access leaves your company
- Let us know before the project begins if you handle regulated data
- Keep the contact for security issues up to date
FAQ
Frequently asked questions
Are you SOC 2 or ISO 27001 certified?
No. We do not hold those certifications and do not claim to. We explain our practices openly so you can judge whether they fit your needs.
Can you sign our NDA?
Yes. We can sign an NDA on request, either ours or yours, before you share confidential information.
Who can see my code and data?
Only the people assigned to your project, with access limited to what they need. We can describe the specific access arrangement for your project on request.
What happens to my data when the project ends?
We hand over what you own and remove our access to your systems. We can discuss deletion of any project data we hold, as part of wrapping up.
What if there is a security issue after launch?
If you are on a retainer or support plan, security fixes are part of the work. If not, contact us and we will advise on options. We will tell you promptly if we learn of an issue that affects your project.
Keep exploring
Related pages
Next step
Have security or compliance requirements?
Tell us up front and we will say honestly whether we can meet them.
- Fixed scope
- Weekly demos
- You own the code