Security & data
You own the code, the data, and the keys to turn it off.
Legal work is privileged. Every choice below is designed so nothing your firm or clients rely on lives at our discretion.
§ 01What you own
IP-clean by default.
Every artefact we produce transfers to you on payment. No dual-license traps, no per-seat rent on the tool we just built, no vendor-owned data.
The source code
Full repository, hosted where you choose. Yours from day one, not on delivery.
Credentials & infra
API keys, model keys, hosting accounts, DNS. Handed over in writing at project end.
The data
Your matters, documents, and outputs live in your storage. We don't retain client data past the engagement.
The prompts & models
System prompts, fine-tuned weights, and evaluation sets are documented and delivered.
§ 02Data handling
Residency, encryption, retention.
Data residency
Deploy in the region your regulator or client expects. Regional AWS / GCP / Azure, on-prem, or your existing tenant. Model calls routed to region-matched endpoints where the provider supports it.
Encryption
In transit via TLS 1.2+. At rest via provider-managed KMS on every hosted deployment. No plaintext client data on developer machines.
Retention & deletion
Working copies, staging data, and logs are deleted at project end unless you ask us to retain for support. Deletion confirmed in writing.
Access
Least-privilege access, MFA on every account, revoked at handover. Named individuals only, no shared credentials, no ex-contractor access left behind.
§ 03Subprocessors
Who touches the software.
Every engagement's specific stack is confirmed in the SOW. Below are the categories we typically use. You can require substitutions or your own tenant for any of them.
| Category | Region |
|---|---|
| AI model provider | Per your requirement |
| Cloud hosting | Per your requirement |
| Source hosting | US / EU / self-hosted |
| Error monitoring | EU by default |
§ 04Incident contact
Something looks wrong? Write us.
For any suspected vulnerability, data-handling concern, or incident on software we built, email us directly. We triage same-day on business days.