Security

For most engagements we deploy into your cloud account under least-privilege roles that you grant and can revoke, with all access logged on your side. Your data does not enter our infrastructure at all.

This is deliberate. It shrinks our attack surface, it means you retain control, and it makes both of our compliance stories simpler. It also means that if our relationship ends, nothing has to be extracted from us — see the exit commitments in our terms.

• SSO with mandatory MFA on every internal system. No exceptions.
• No shared credentials. Secrets live in a managed secret store, never in code, config files or chat.
• Client environment access is per-engineer, time-bound where possible, and granted at the minimum privilege the task needs.
• Quarterly access reviews with a written record, plus immediate revocation on role change or departure — offboarding is a checklist with a named owner, not a memory.
• Production access requires a documented reason and is logged centrally.

• TLS 1.2 or above for all data in transit, HSTS enforced.
• Encryption at rest using the platform’s managed keys — AES-256 or equivalent — for every store we operate.
• Full-disk encryption mandatory on all endpoints.
• Client-managed keys available for engagements that require them.

• Every change goes through pull request review. Nobody merges their own work to production.
• Dependency, container image and infrastructure-as-code scanning in CI, gating new critical findings.
• Secret detection at pre-commit and in the pipeline, with history remediation where something slipped through — and rotation first, because a committed key is compromised whether or not you rewrite history.
• Infrastructure defined in Terraform, so a change to a network rule is a reviewable diff rather than a console action.
• Static analysis on application code, tuned to keep the signal usable.

LLM features add a surface that conventional application security does not address. On every system we build:

• Prompt injection defences — untrusted content is never treated as instruction, and tool authority is scoped deliberately rather than inherited from an API key.
• Least-privilege agents— an agent acts with the signed-in user’s real entitlements, enforced at query time, not with a service account that can see everything.
• PII handling — minimisation and redaction before anything leaves your environment, and scrubbing before anything reaches a log line.
• Zero retention with model providers — contracted, and no training on your data.
• Request-level audit trail — what was asked, what context was retrieved, what was answered, by which model version.
• Cost and rate guards — so a runaway loop or abuse attempt produces an alert, not an invoice.

• Centralised audit logging with alerting on anomalous access patterns.
• Documented incident response runbooks, rehearsed in tabletop exercises rather than only written.
• Blameless post-mortems for every incident, with a fix that lands — a repeat alert without a fix is treated as our failure.
• Client notification of any breach affecting their data within 24 hours of becoming aware, per the DPA.

• Backups with defined RPO and RTO for everything we operate, and quarterly restore tests with a written result. A backup that has never been restored is a hypothesis, and testing it is the single most common gap we find in client estates.
• Disaster recovery rehearsed quarterly on managed engagements, not just documented.
• Infrastructure reproducible from code, so recovery is a re-apply rather than an archaeology exercise.

• Background verification for all employees before start.
• Confidentiality obligations that survive employment, extended to any contractor.
• Security and data protection training at induction and annually, including AI-specific risks.
• A documented joiner, mover and leaver process — this is where most real-world access failures originate.

If you believe you have found a vulnerability in our systems, email [email protected]. We acknowledge within one business day and aim to remediate critical issues within seven days.

We will not pursue legal action against good-faith researchers who avoid privacy violations, service degradation and data destruction, and who give us reasonable time to fix an issue before disclosing it. We are happy to credit you.

Stated honestly on the compliance page — including which certifications are held, which are in progress with target dates, and which we do not have. We would rather lose a deal than imply a certificate we have not earned.