Trust
Security, data handling & trust
How we protect your data, what we guarantee in every engagement, and the certifications we hold or are working towards.
Security practices
How we protect your data
Your environment, your accounts
We build inside cloud accounts and repositories that you own. Access is granted per project with least privilege and can be revoked at any time. Nothing critical lives only on our machines, and hand-over needs no migration.
No training on your data
Hosted models are used through enterprise or API tiers whose terms exclude training on customer data, with zero-retention options where available. Where that is not acceptable, we deploy open-source models inside your environment so data never leaves it.
Documented data flows
Every project ships with a data-flow diagram showing what data moves where, which services touch it and how it is protected. Compliance and security teams get the evidence they need without reverse-engineering the system.
Encryption and access control
Data is encrypted in transit and at rest using your cloud provider’s standard controls. Secrets are kept in managed vaults, service accounts are scoped narrowly, and role-based permissions from your source systems are preserved in AI applications such as knowledge assistants.
Secure development practice
Code is reviewed before merge, dependencies are scanned, and AI-specific risks such as prompt injection, data leakage through outputs and unsafe tool actions are tested explicitly. Sensitive agent actions require confirmation and are logged.
Agreements and confidentiality
We sign NDAs before discovery and data-processing agreements before touching production data. Team members working on your project are named, and we can complete your vendor security questionnaire as part of onboarding.
What we guarantee
What every engagement includes
Fixed-price discovery
Discovery sprints are quoted as a fixed fee with a defined output: ranked opportunities, an architecture sketch, a delivery plan and a costed proposal. If the outcome is “AI is not the right tool here”, we say so, and you keep the analysis.
Weekly working demos
You see running software every week, not slides. Priorities can change between iterations, and there is never a long silence followed by a surprise. Progress, risks and evaluation results are written up in a weekly update you can forward internally.
You own the code and models
Everything we build (code, prompts, fine-tuned weights, evaluation sets and documentation) is delivered in your repositories and accounts under your ownership. Hand-over includes runbooks and pairing sessions so your team can maintain and extend it.
No lock-in
We use mainstream, well-documented tools and design the model layer to be swappable. There are no proprietary platforms, no exclusive licences and no minimum term beyond the agreed scope. Staying with us after launch should be a choice, not a necessity.
Profiles & certifications
Profiles & certifications
- Clutch profile · TODO(owner): add Clutch profile URL and current rating once the profile is live and reviews are verified. Do not display a rating until confirmed.
- GoodFirms listing · TODO(owner): confirm listing status and add URL. Show only if the listing is claimed and accurate.
- ISO 27001 · Not yet certified. TODO(owner): decide whether to pursue certification; until then display as “security practices aligned with ISO 27001” only if the practices above are audited internally.
- SOC 2 · Not yet certified. TODO(owner): do not display a SOC 2 badge; offer the security overview and questionnaire responses instead.
- GDPR-ready data handling · TODO(owner): confirm DPA template and data-flow documentation are in place before displaying; phrase as “GDPR-ready processes”, not a certification.
- Cloud partner status · TODO(owner): confirm any AWS, Azure or Google Cloud partner tier before showing a partner badge; omit if none.
Read our privacy policy and terms of service, or ask us for a data-processing agreement.
Ready to chart your AI course?
A free 30-minute consultation: we listen, ask hard questions and tell you honestly where AI will and won't help.