How we use AI
We built our own system for directing AI models through engineering work. It hands bounded tasks — a function, a test suite, a migration, a research question, a review — to models from several providers, each task in an isolated environment with a hard spending ceiling enforced by the provider. A second model, independent of the one that did the work, reviews it before a human decides whether it ships.
What AI never decides
- Architecture, scope, and what gets kept, changed, or blocked.
- Whether a review finding is real. We reproduce findings with a test before acting on them.
- What ships to your systems.
- Anything safety-critical, clinical, or legal. In the clinical and legal software our team has built, AI drafts and a licensed professional attests before anything is relied on.
What AI can and can't reach
- Model-run tasks work on a copy of the code in an isolated environment, with no shell, no network, and no ability to read secret files.
- They never receive production credentials or direct access to production systems.
- We don't put client credentials, protected health information, or regulated data into prompts.
Which providers' models receive which parts of your code depends on the engagement. We tell you which providers are in use before work starts.
Your controls
- Restrict: tell us at the start which code, data, or documents must not go to any AI model, and we'll keep them out.
- Opt out: you can ask for an engagement delivered without AI‑assisted work. It will take longer and cost more, and we'll say by how much before you decide.
What we don't claim
We don't claim our AI tooling is error-free — that's why review and tests exist. We don't claim certification or compliance under the EU AI Act, NIST AI RMF, or ISO/IEC 42001. We don't market speed multipliers we can't show you.