SEC
Security and trust
We build software that handles real business data, so security and data protection are part of every project from the first conversation. This page sets out what we do as standard. We do not claim certifications we do not hold.
SEC.1
What we do as standard
- UK GDPR by design
- Data protection is part of the specification: what personal data is processed, why, where and for how long. We help you run a DPIA when a project needs one.
- AI data handling
- We use model providers and settings that do not train on your data, choose UK or EU processing where it matters, and can run open-weight models on your own infrastructure.
- Least privilege
- Integrations and MCP servers get only the permissions they need. Write actions are added one at a time and can require human approval.
- Audit trails
- AI and automation actions are logged with inputs, outputs and who approved them.
- Secure delivery
- Code review on every change, dependency updates, secrets kept out of repositories, and automated tests in CI.
- You own everything
- Code in your repository, infrastructure in your accounts, and documentation so another team could take over.
SEC.2
Related
T+99Next step
Talk it through with us
A free 30-minute first chat, with no obligation. Tell us what is getting in the way; we tell you honestly what we would do, roughly what it would take, and whether it is worth doing at all.