Skip to content

For your security reviewer

Security and data handling, stated plainly

Written for the person who has to approve an outside engineering team before anyone signs. This page describes how we work today; where we do not hold a certification, we say so.

Where the work runs

  • In your Google Cloud project, under your identity provider, logging, and access controls.
  • Engineers work with the access you grant, under your identity provider.
  • We work inside your repositories.

Where the results live

  • Code, infrastructure as code, prompts, evaluation suites, runbooks, and dashboards live in your accounts from the first commit.
  • Inquiry data from this website: see the website section below.

Model and data decisions

  • Model and prompt choices are reviewed for data-handling implications before production.
  • Each decision is recorded in a decisions/ folder in your repository: what was chosen, what was rejected, and the evidence.
  • Model and prompt deploys are versioned and can be rolled back.

This website

  • The contact form collects only name, email, company, and message.
  • Submissions are stored in Google Cloud (Firestore) in the United States and a copy is sent by email to our hello@ inbox, so the people who respond see it.
  • The endpoint never stores a raw IP address; only a salted hash, used for rate limiting.
  • Inquiry data is retained for 24 months after our last contact; data requests are answered within 30 days.
  • No analytics or advertising cookies; no third-party scripts; a strict Content Security Policy you can verify from the response headers.

Full wording in the privacy policy.

What we do not claim

We do not hold a SOC 2 report or an ISO 27001 certification, and we do not imply one. Work runs inside your controls.

If your process needs a specific document, ask. We reply within two business days.

Questions reviewers ask

How do you handle security and data?

Work runs in your cloud project under your identity provider, logging, and access controls. Model and prompt choices are reviewed for data-handling implications before anything reaches production, and every decision is documented so your team can defend it later.

Where does the work we produce live?

Everything we produce lives in your accounts from the first commit: repositories, infrastructure, prompts, and evaluation suites. Nothing transfers at the end because nothing ever left.

Can we send you a security questionnaire?

Yes. Send it to [email protected] and we reply within two business days.

Send the questionnaire.

Email it to [email protected] or use the form. We reply within two business days.

Book a free 30-minute scoping call

We reply within two business days. No deck or RFP needed.