Security, confidentiality and ownership

Contracts and ownership

• NDA first: yours or our mutual template, signed before you share a roadmap, a codebase or a customer list.
• IP assignment: everything we create for you is assigned to you under the services agreement. We keep no licence to your product and reuse no client code between projects.
• Your repository from the first commit: code lives in your GitHub, GitLab or Bitbucket organisation, not ours. There is nothing to transfer at the end because it was never anywhere else.
• Your accounts for cloud, app stores, domains, analytics and third-party services. We ask for access; we do not own anything on your behalf.
• Confidentiality for every engineer: each person on your project is bound by a confidentiality agreement with us that covers your material, and only people on the project have access to it.

Access and accounts

• Least privilege: engineers get the access the task needs and no more, granted through your identity provider or named accounts, never a shared login.
• Two-factor authentication on every account that touches your systems, including source control, cloud consoles and communication tools.
• No production data on laptops: development and testing run against anonymised or synthetic data; production access is read-only, logged and limited to named people when it is needed at all.
• Secrets in a vault, not in repositories, chat or documents. Keys are rotated when a person leaves a project.
• Offboarding on the day: when an engagement ends or a person rolls off, their access is revoked the same day and you receive a list of what was revoked.

How the code is built

• Review on every change: no pull request merges without a senior review, and CI runs tests, linting, dependency and secret scanning before anything reaches your main branch.
• Infrastructure as code: environments are defined in Terraform or your cloud’s native tooling, with encryption at rest and in transit, private networking and backups configured by default.
• Dependencies kept current with automated update checks, and vulnerable packages patched as part of normal work.
• Built for the regulations your product meets: audit logs, consent, data retention and deletion for the DPDP Act and GDPR; HIPAA-aligned handling for health data; PCI-aware payment integrations that keep card data with the processor.
• Monitoring and alerting set up before launch, so incidents are seen by us and by you.

Data protection

We act as a processor on your instructions where personal data is involved, under a data processing agreement, with standard contractual clauses for clients in the UK and the EU. Production data stays in your environment and in the regions you choose; our engineers work against anonymised or test data wherever the task allows. For Indian clients we design to the Digital Personal Data Protection Act, 2023.

If we become aware of an incident affecting your data, you hear from us without delay with what is known, what has been done and what we recommend, and we support your notifications to regulators and users.

Compliance posture

We do not currently hold a SOC 2 report or an ISO 27001 certificate of our own. Our practices are built to those frameworks, we complete client security questionnaires in full, and we work inside the controls of clients who are certified, including their device, access and change-management requirements. If your procurement needs a specific certification, tell us early and we will say plainly whether we can meet it.

When the engagement ends

Handover is part of every project: documentation, architecture notes, runbooks, infrastructure as code and a recorded walkthrough. Access is revoked, local copies of your material are deleted, and we confirm both in writing. If you later need us again, we start from your repository like anyone else would.

Security questions