your data. your code. your software.
Custom software means letting someone inside your business. Here's exactly how we treat that access: what we take, what we don't, and what you keep. No legalese, no fine print.
Data handling
UK South
Azure UK South by default, EU on request. US only where you require it.
Nothing
Working copies are deleted at the end of the engagement. You do not have to ask.
Encrypted, restores tested
Backups do not cross a border the data itself has not: a UK deployment's backups stay in the UK.
MFA on every system
Multi-factor authentication on every system that touches client code, on scoped accounts revoked the day we finish.
Sub-processors and AI
| vendor | purpose | region |
|---|---|---|
| Microsoft Azure | hosting and infrastructure | UK South |
| GitHub | source control and CI | United States |
| Anthropic | model access for our build tooling | United States |
| OpenAI | model access for our build tooling | United States |
30 days' notice
UK GDPR Art. 28(2): you are told before a sub-processor is added or replaced, and you can object.
Never used for training
Client code reaches a model only through build tooling we wrote and run ourselves, against vendor APIs whose terms prohibit training on what is sent — never a consumer chat product. Inputs may be held up to 30 days for the vendor's abuse monitoring; we hold no zero-retention agreement. Credentials, personal data and production databases never go near a model.
Incident response
12 hours
Confirmed incident involving your data.
24 hours
Suspected incident, no confirmed exposure.
72 hours
Security-relevant event with no client impact.
The architecture diagram is drawn for your engagement rather than pulled off a shelf — you get the one that describes your system, not a generic picture.
We see the minimum. You keep everything.
An audit needs visibility, not custody. We work against the smallest slice of data that answers the question, anonymised or synthetic where possible.
- Least-access by default: scoped accounts, revocable the day we're done
- GDPR-aligned handling; EU data stays in the EU when you need it to
- Your data is never used to train anything, sold, or shared
- Working copies deleted at the end of every engagement, without you asking
You own the code. All of it.
The software we build for you is yours: source, infrastructure config, documentation, the lot. We don't rent you your own product.
- Full IP assignment on delivery, in plain contract language
- Standard, boring stacks: any competent team can take over
- Code escrow available for the cautious
- No lock-in: leaving us costs you a handshake, not a migration
NDA first. Names never.
Most engagements start with an NDA before we see anything, ours or yours, whichever's stricter. What we learn inside your business stays there.
- NDA by default before any audit begins
- Named access list: you know exactly who can see what
- No case studies, logos, or numbers published without written consent
Boring, disciplined, auditable.
Security isn't a feature we add at the end. It's how the work happens, from the first commit.
- Secrets live in managed vaults, never in code, chat, or email
- Least-privilege access for every environment, reviewed monthly
- Dependencies audited and pinned; updates are deliberate, not drive-by
- Every change reviewed before merge; every release versioned and reversible
Compliance-ready from day one.
We deploy on infrastructure your auditors already trust, configured so a future SOC 2 or ISO journey starts from "mostly done" rather than zero.
- SOC 2-ready cloud providers; UK South by default, EU on request, US only where you require it
- Encryption in transit and at rest, everywhere, no exceptions
- Automated backups with recovery we test, not assume
- Audit logs your compliance team can read without calling us
The quiet part, out loud.
Some of the industry's defaults aren't ours. For the avoidance of any doubt:
- No analytics, trackers, or phone-home code hidden in your product
- No reselling, benchmarking, or "anonymised insights" from your data
- No shadow subcontracting: the people you meet do the work
- No hostage tactics: access, docs, and keys are handed over as we go