Security & IP
What we do with your access, your data and your code
Written out so your security questionnaire is mostly answered before you send it. We have limited the claims below to things we can actually demonstrate.
Access control
- Two-factor authentication required on every account we hold
- Least-privilege access, granted per engagement and revoked at handover
- A password manager with no shared plaintext credentials, ever
- Access reviewed when anyone joins or leaves a project
Your data
- Production data is not copied to developer machines; we work from anonymized or synthetic fixtures
- US or Canadian hosting regions, chosen to fit your compliance obligations
- Encryption in transit and at rest on everything we provision
- Backups configured and restore-tested, not just enabled
How we build
- Dependencies pinned and scanned for known vulnerabilities
- Secrets in a managed store, never in the repository
- Code review before anything reaches production
- Audit logging designed in where the domain requires a trail
Ownership and exit
- You own all deliverables outright on final payment — in writing
- Repository, cloud account, domains and store listings in your name from day one
- Full credential handover, with a recorded walkthrough
- No license to renew, no proprietary framework holding you in place
Questions
What procurement usually asks
Are you SOC 2 or ISO 27001 certified?
No, and we will not claim to be "aligned" with either, because procurement teams correctly read that as not certified. What we can do is complete your security questionnaire honestly, work inside your own controls and tooling, and sign whatever confidentiality terms your legal team requires.
Will you sign our NDA and MSA?
Yes. We have our own templates ready if you would rather start from something, but we are equally happy to work from your paper. Confidentiality terms are not where we negotiate.
Can our data stay in Canada, or in the US?
Yes, either. We provision in the region your obligations require — this comes up most often with healthcare and public-sector work, and it is a scoping decision, not an afterthought.
What happens to access when the project ends?
We hand over every credential, transfer ownership of accounts created for you, and remove our own access. You get a written confirmation of what was revoked and when.
Do you use AI tools on our code?
We use AI-assisted development, and we configure those tools so your code is not used for model training. If your contract or policy prohibits it on your codebase, we turn it off for your engagement and say so in writing.
Need us to complete a security questionnaire?
A 30-minute call, a straight answer on fit, and one fixed written price if it makes sense. If it does not, we will say so — and point you somewhere better.
- United States
- +1 (646) 555-0188
- Canada
- +1 (437) 555-0142