SOC 2 Type II
Audited annually. Report available under NDA on request.
Trust centre
How we handle your data, and who checks
Everything a procurement or security review usually asks for, in one place. If something is missing, write to us and we will add it.
Certifications
Independently audited
ISO 27001
Certified information security management system, surveilled yearly.
GDPR
Standard DPA, EU standard contractual clauses, and named subprocessors.
AI governance
What we commit to on every model we build
Risk tiering
Every system is classified at design time against the EU AI Act risk tiers, before any code is written.
Model cards
Intended purpose, training data provenance, evaluation, known limitations and oversight, stored with the code.
Human oversight
Any decision affecting an individual has a logged override path and a named person able to use it.
No training on your data
Client data is never used to train shared or third-party models, and never leaves the region you specify.
Subprocessors
Who else touches data, and where
| Subprocessor | Purpose | Data location |
|---|---|---|
| Cloud provider of your choice | Compute and storage for delivery work | Region you specify |
| Source control provider | Code hosting for engagement repositories | EU or US |
| Communication platform | Project messaging, no client data stored | EU |
| Ticketing system | Delivery tracking, metadata only | EU |
Vulnerability disclosure
If you find something, tell us
Write to company@domain.comwith steps to reproduce. We acknowledge within two business days and aim to resolve or publish a mitigation within thirty.
We will not pursue legal action against researchers acting in good faith who avoid privacy violations, service disruption and data destruction.
Acknowledgement
2 days
Resolution target
30 days
Tell us which number you cannot trust
Send one paragraph about the report that always starts an argument. A data lead, not a salesperson, replies within one business day.