Trust center
Security, IP and AI, in plain language.
What your security, legal and procurement teams need to sign off on working with us, including exactly how we use AI agents on your code.
SOC 2 Type II · IP assigned to you · Least-privilege access
01 Security and compliance
SOC 2 Type II, and built to fit your program.
We work inside your security program: your agreements, your access controls, your review process.
SOC 2 Type II
Independently audited security controls. The report is available under NDA on request.
Your paperwork, signed
DPAs, security addenda and NDAs, as your procurement and legal teams require.
Security reviews
We complete vendor security questionnaires and assessments as part of onboarding.
02 Intellectual property
Your IP is yours, in writing.
Everything we build for you belongs to you. The contract assigns all work product to your company, with assignment flowing through from every engineer on the team.
Assigned by contract
All deliverables and IP created during the engagement are assigned to your company.
No gaps in the chain
Every engineer assigns IP to us, and onward to you.
No lock-in
You own the code, the documentation and the agent context we build around it.
03 Data protection and access
We work inside your environment, not around it.
Access to your code and data is provisioned through your systems, scoped to the work and revoked when the engagement ends.
Least-privilege access
Granted through your identity provider and tooling, scoped per person, and removed at offboarding.
Data residency
Where your data lives and how it's isolated is agreed per engagement to meet your compliance needs.
Auditable by default
Work happens in your repositories, tickets and logs, so every change has a trail you control.
04 AI agents and your code
Agents work behind the same gates as engineers.
Coding agents are part of how we deliver. They get no more access than the engineer running them, and production stays behind a human decision.
Environment segregation
Agents build and test in non-production environments. Production stays separate from development and test, as your policies require.
Gated production access
Where agents help with monitoring and troubleshooting, access is read-only, scoped and approved. Nothing an agent does reaches production without a person signing off.
No training on your code
We use AI tools under business terms that exclude your code and data from model training.
Human-owned changes
A seasoned engineer reviews every agent-assisted change before it merges, and is accountable for it.
05 Due diligence
Need our SOC 2 report or a questionnaire filled in?
Tell us what your security and procurement teams need. We'll get you the documents and the answers.