TRUST & SECURITY
Security, access, and how we use AI.
An engineering partner ends up holding your credentials, your codebase, and sometimes your customers' data. These are the controls that come with us by default.
Baseline controls
What we bring to every engagement.
Access & identity
Least-privilege client access
MFA and passkeys
Named access per engagement
Offboarding on handover
Credentials & data
No shared logins
Managed secret storage
Encrypted in transit and at rest
Client data deleted on request
Engineering practice
Every change reviewed
Automated test suites
Dependency scanning
Documented runbooks
Operational resilience
Automated backups
Restore testing
Incident response
Vendor risk review
Disclosed AI use
How AI is used on client work.
OUTPUT REVIEW / REQUIRED
Generated change
Drafted from 6 repository files
SpecSchemaTests+3
No change reaches production until an engineer reviews and approves it.
Generated code is read and understood by the engineer who ships it.
Model output is tested like any other change, never merged on trust.
We check what your agreement permits before your code reaches a third-party model.
Agents get narrow permissions, approved tools, and explicit stopping conditions.
BEFORE YOU ASK
Happy to answer the hard questions first.
If your security team needs to review us before work starts, ask early. We would rather answer a questionnaire up front than discover a blocker halfway through a build.