Security and access
How we handle your code, your credentials and your production system.
You are giving an outside firm access to the software your business runs on. This page says exactly what we do with that access.
Before any access
A signed confidentiality agreement comes first. We use yours or ours.
Access to your code
Read-only to start. Write access only when a fix is agreed, on a named account you can switch off at any time.
Credentials
Shared through your password manager or a one-time secret link. Never by email or chat.
Production changes
Nothing changes in production without your written approval and a tested way back.
Your customers' data
We work on anonymised or sample data wherever the problem allows it. Where it does not, we work inside your environment on a named account. We keep no local copy after the engagement ends, and you receive a written handover.
AI tools
If you would prefer that no AI tooling touches your code, tell us at triage and we will work without it.
Who owns the work
You own the report and anything we write for you, assigned to you on full payment. We keep no claim over your code or your business rules. We reuse our own methods and templates, never your code or your data.
Liability
Our liability on any engagement is capped at the fees you have paid for it.
When the work ends
You remove our access, we delete local copies, and you get a written handover.
Insurance and certifications
We're a focused specialist practice, not a large vendor — the person who does the work is the same person accountable for it, with no account layer in between. We don't hold SOC 2 or ISO 27001 certification, and we don't currently carry professional indemnity insurance. If your procurement process requires either, raise it at triage and we'll give you a direct answer on fit — no runaround, no vague reassurances.