Trust
How we handle your data, code and AI.
Bringing AI into a business means trusting someone with your customers' data, your systems and your reputation. These are the practices behind every project we build.
Last updated
- 01
You own what we build
- The code, designs, documentation and data created for your project belong to you, and they live in accounts you own: your code repository, your cloud and hosting accounts, your domains.
- Nothing we deliver depends on a hidden license or a platform only we control, so you can take the work to another team at any time.
- 02
Access to your systems and data
- We ask for the least access the work needs, through individual accounts with multi-factor authentication rather than shared logins.
- Credentials and API keys are kept in a password manager or secrets store, never in code, email or chat.
- Where we can, we build and test with sample or anonymized data instead of copying real customer records.
- Project details, data and documents you share stay inside the team working on your project.
- 03
Which AI we use and what happens to your data
- We build on the business and API offerings of established model providers, chosen for each project. We check each provider's current data terms for your project, and favour terms under which your data is not used to train their models.
- Where data cannot leave your environment, we can design around that, for example with providers that support your region and compliance needs, or with models hosted in your own cloud.
- Your prompts, documents and outputs are not used to train anything of ours.
- 04
Human oversight for AI that takes action
- AI assistants and agents we build answer from your approved information, and they are designed to say when they do not know rather than guess.
- Actions with real consequences, such as payments, refunds, contract changes, medical or legal questions, or anything sent on your behalf, need a person's approval or are escalated to your team.
- Every AI action is logged, so you can see what it did and why, and usage and cost limits are in place before launch.
- Before launch we test the system against real examples from your business, and we keep measuring quality after it goes live.
- 05
Regulated and sensitive data
- If your project touches health, financial, legal or children's data, we identify the requirements that apply at the start of scoping and design for them. That includes provider agreements where they are required, data residency and retention rules.
- We tell you plainly where a requirement needs your compliance team or legal counsel, rather than claiming certifications we do not hold.
- 06
Security in what we ship
- Data is encrypted in transit and at rest using the security features of the hosting and database platforms we build on.
- We keep dependencies patched, review changes before they reach production, and set up monitoring, backups and alerts as part of launch, not as an afterthought.
- You get documentation and a handover, so your team, or any team you choose, can run and extend the system without us.
Have a security or compliance question?
Ask before you share anything sensitive, and we will answer it directly.