Trust Last reviewed: September 2026

Trust, security and compliance.

What we do to keep AI systems secure and compliant, written for the person who has to sign off on it — including the parts where the honest answer is 'not yet'.

WHAT WE CAN EVIDENCE TODAY

CERTIFICATION STATUS

We do not currently hold SOC 2, ISO 27001 or HIPAA certification.

Most agency sites in this space display those badges as design elements. We would rather tell you plainly, because a vendor claim you cannot verify is worth less than an honest one — and because procurement will check.

What we do is implement the controls those frameworks describe, document them per engagement, and build systems that generate the evidence your auditors need. Clients who hold certifications we do not can still use us: the systems we build are designed to sit inside their certified scope.

When we complete a certification, it will appear here with its audit date and scope, and in the machine-readable version of this site. Until then, this page says what is true.

HOW WE WORK

THE COMMITMENTS

We configure so your data is not training data

Where the provider offers it, we use enterprise model endpoints configured for zero retention and no training on inputs — at the time of writing; we confirm the provider's current terms per engagement — and we state the exact configuration in the architecture document rather than pointing at a general policy page. Zero retention is at the provider; your own logs stay in your infrastructure under your retention policy.

You own everything we build

Code in your repositories, infrastructure in your accounts, any fine-tuned weights yours. No proprietary platform and no runtime dependency on us.

Sub-processors are named

Every third party in the processing path, including model providers, disclosed with role and region. No unnamed "trusted partners".

We answer questionnaires honestly

Where a control is not in place, the response says so. We would rather lose a deal on a truthful answer than win one on a carefully worded almost-yes.

QUESTIONS

QUESTIONS — 4

If it is a hard gate in your procurement policy, no — and we would tell you that on the first call rather than in week six. Some organisations can accept a risk exception for a small engineering supplier with documented controls; that is a decision for your risk function, not something we would try to argue you into.

Wherever your requirements dictate. EU regions for EU data residency, your own VPC where that is required, or entirely on your hardware with open-weight models where nothing may leave the perimeter. The residency requirement is captured in discovery because it constrains model selection, and discovering it late causes rework.

As an authorisation problem, not a filtering one. Retrieved content — documents, tickets, web pages, emails — is designed to be treated as untrusted data rather than as instructions. Tools carry the minimum permission needed, destructive operations require confirmation, and the design does not allow retrieved content to authorise a subsequent tool call. Filtering helps at the margin but cannot be the primary control.

Yes, and we can work from your paper. Standard contractual clauses where a transfer requires them. For engagements where we never hold your data — systems running entirely in your infrastructure — we will say so rather than papering over a processing relationship that does not exist.

TRUST — ALL PAGES