Security & Data Handling

Access & least privilege

We request the minimum access needed for each engagement — separate staging credentials where possible, time bound access for production, and no shared passwords in chat or email.

• Individual accounts and MFA on client systems we touch
• Secrets stored in environment managers or parameter stores — never in repos
• Access revoked or rotated at project end unless retainer continues

Code & repository practices

Client code stays in client owned repositories when required. We follow branch protection, review on critical paths, and avoid committing credentials or PII to git history.

• Private repos and signed commits where client policy requires
• Dependency scanning and pinned versions on maintained projects
• No subcontracting without explicit client approval

Data handling & AI workflows

Automation and AI features often process documents, leads, and support content. We design retention, redaction, and logging so sensitive data does not leak into the wrong stores or model training paths.

• API configurations aligned to provider zero retention options when available
• PII minimization in prompts and structured tool outputs
• Audit friendly logs without storing full message bodies when not required

Cloud & infrastructure

AWS deployments use VPC isolation, encrypted storage, IAM roles over long lived keys, and backups with tested restore paths — standard on SaaS and integration projects we operate.

• TLS in transit for public endpoints and internal service communication
• CloudWatch or equivalent monitoring with alert routing
• Infrastructure as code where environments must be reproducible

Incident response & communication

If something goes wrong, we prioritize containment, client notification, and documented remediation. Retainer clients receive agreed response windows; project clients receive handoff runbooks for ops they own.

• Clear escalation contacts during active engagements
• Post incident summaries with root cause and preventive changes
• No public disclosure of client systems without written approval

Compliance scope

We implement technical controls that support your compliance goals — encryption, access logs, retention policies — but we do not act as your legal counsel or certify SOC 2 on your behalf. We coordinate with your compliance team when audits require evidence.