Security & Data Protection

We work with business data, internal systems, and operational processes that we must keep confidential. The procedures on this page apply to all our client projects. These projects include data platforms, AI systems, internal tools, and business-critical software.

Project agreements give the specific commitments. If personal data is part of the project, a Data Processing Agreement also gives commitments.

Confidentiality

• Mutual confidentiality applies to all client projects. Our standard procedure is to sign a non-disclosure agreement (NDA).
• We do not share client data, source code, business documents, or strategic information outside the project team.
• We do not publish client names, project details, or anonymised case studies without written permission.

Access control

• We give access to client systems only to named persons who must have it for their work.
• We use multi-factor authentication on all systems that support it.
• We examine access during the project. We remove access when the project stops or when the team changes.
• We keep production access separate from development access if the client environment supports this.

Source code and development environments

• We keep code in repositories that the client selects, such as GitHub, GitLab, or Azure DevOps. These repositories are in the client account, or they are dedicated repositories where the client has administrative access.
• Local development environments use scoped credentials that we can replace.
• We do not keep copies of client source code on personal devices after a project stops.

Client data

• We do not move client data outside the client environment unless the project requires it and we have written permission.
• If possible, we use anonymised or synthetic data for development and tests.
• If personal data is part of the project, a Data Processing Agreement controls how we process it. We also align our procedures with applicable data protection law. This includes the GDPR where it applies.

Cloud and infrastructure

• We work in the cloud accounts and tenants that the client selects, such as AWS, Azure, or GCP.
• If we operate infrastructure for the client, we use the principle of least privilege. We also apply network, identity, and audit controls that are applicable to the workload.
• We manage secrets and credentials through the secret management tools that the client selects.

AI and models

• We do not use client data to train third-party general-purpose models unless we have explicit permission.
• If AI features are part of a project, we record the models, providers, and data flows that the project uses.
• We help clients to find the AI providers and deployment options that satisfy their requirements for data residency, retention, and confidentiality.

Subprocessors

If you ask, we supply a current list of the subprocessors that we use for delivery. We supply this list at the start of a project or during due diligence.

Incident response

At the start of each project, we agree on when and how we tell the client about incidents. If an incident has an effect on client data or on systems that we operate, we tell the client without undue delay. We also help to correct the problem, and we do a post-incident review.

Due diligence and procurement

If you need documents for procurement, vendor risk, or compliance, send a short description of your request through the contact form. These documents include security questionnaires and Data Processing Agreements (DPAs). We will answer quickly.