AI providers
We usually build with OpenAI and Anthropic, and we've worked with more than 10 AI providers. We use whichever one your needs and your legal requirements allow.
How we handle your data and security
We don't hold SOC 2, ISO 27001, or any other security certification. This page describes what we do instead: hosting you control, access by role, AI that never trains our models on your data, and a plan for when something goes wrong.
What we do
What we do
Hosting region
You choose where your data is hosted: the EU or the US.
Agreements
We sign an NDA on almost every project, and a data processing agreement when your data needs one.
Model training
We never train our own models, or any model reused across clients, on your data, and we don't use AI providers that train on it by default. If you want a model that learns from your work, we can train one that is yours alone, on your written instruction and inside your own accounts.
Local AI
For regulated work, we can build with a local or self-hosted model, so your data stays on your network. It costs more and performs differently, and we say both up front.
Access control
Access to your systems - code repositories, no-code platforms, your project portal - is set up per client, by role.
Team agreements
Everyone on our team works under an agreement with us, and loses access when they stop working with us.
Client ownership
You own the code, workflows, accounts and documentation.
Subprocessors
Who else touches your data
Used only where the project needs them, and not every project uses all of these. The full list for your build comes with your Blueprint and again at handover.
Anthropic
AI model provider
When Claude is the model used for the build
OpenAI
AI model provider
When GPT models are the model used for the build
Supabase
Database and backend hosting
Custom application builds on Supabase
Vercel
Application hosting
Custom application and website builds
Bubble
No-code application platform
No-code builds
n8n
Automation and workflow platform
Automation engagements
Make
Automation and workflow platform
Automations where your setup already runs on them
Zapier
Automation and workflow platform
Automations where your setup already runs on them
Xano
Backend platform
Some application and automation builds
Webflow
Website platform
Website builds on Webflow
Data flow
How your data moves
Your data enters the system you control - your CRM, your inbox, your uploaded files, or directly from your own users.
Incident response
If something goes wrong
We monitor for problems, contain and fix quickly, and tell you within 72 hours of confirming an incident that affects your data.
Within 72 hours
We monitor, contain, and tell you within 72 hours.
Agreements
Agreements on request
We sign an NDA on almost every project, and a data processing agreement when your data needs one.
Security questionnaire
Ask for a data processing agreement or our full security questionnaire pack and we'll send it.
GDPR and the EU AI Act
We don't sell certificates. We design for your obligations from the start: a data processing agreement when needed, hosting in the region you choose, and access limited by role. If what you want to build falls under the EU AI Act, we'll tell you on the first call what it means for the design, which usually comes down to human oversight and a clear record of what the AI did.
See the full methodology
Have a security questionnaire?
Send it over and we'll fill it out from this page, plus whatever's specific to your project.
Book a free strategy call