What we don't hold
We are not SOC 2 audited, ISO 27001 certified, HITRUST certified, or PCI-DSS assessed, and HIPAA has no certification program, so we don't claim one. If your procurement process requires one of those reports, tell us early — we'd rather say so before you've invested time than after.
What follows is what we actually do. Where a practice depends on an engagement's specifics, we say so.
This website
This site loads no third-party scripts, fonts, analytics, advertising pixels or trackers, and sets no cookies. Its content security policy permits only its own origin, plus our own API for the contact form, so a browser refuses anything else. A page ships about 2 KB of JavaScript, all of it ours.
You can check this yourself: open your browser's developer tools on any page, and the network tab lists every request. They all go to this site's own host; sending the contact form adds one request to our API.
Data isolation
The multi‑tenant systems we build enforce customer isolation in the database itself — PostgreSQL row‑level security — not only in application code, and we verify it with automated tests rather than inspection. We hold our own systems to the same rule: the table behind this site's contact form has row‑level security enabled with no public access, and we tested that the public API key can neither read nor write it.
Secrets
- Credentials live in environment and secret storage (for example, our hosting provider's variable store), never in source code or commit history.
- Server-only keys stay server-side. A key with elevated database privileges never ships to a browser.
- We don't put credentials or client data (records, personal information, protected health information or other regulated data) into AI model prompts. When an engagement uses our AI engineering system, AI models do read the parts of your source code the task needs: they work on a copy in an isolated environment that cannot read secret files, you are told which providers' models are in use before work starts, and anything you name is kept away from AI entirely. How AI is used in your engagement.
Environment separation and least privilege
Each system we operate has its own isolated project and credentials, never shared with another company's infrastructure. Access is scoped to what a task needs.
Review and testing
Nothing we write ships on its author's say-so. Every change is reviewed by a second, independent seat — and when a review finds a problem, we reproduce it with a failing test before fixing it. See How We Work.
AI-use boundaries
AI models do bounded implementation and review work in isolated environments, under hard spending limits, with no shell or network access and no access to production systems or client credentials. A human decides what ships. Details are on Responsible AI.
Encryption
Traffic to this site and its API is encrypted in transit (TLS), and data is encrypted at rest by our infrastructure providers' defaults. We don't claim encryption beyond what our providers document.
Regulated data
Please don't send protected health information, payment card data, or other regulated data through our contact form. If an engagement needs to touch regulated data, we agree on how — including any Business Associate Agreement — before any of it is shared. See Data Processing.
Reporting a vulnerability
If you believe you've found a security issue in this site or anything we operate, tell us through the contact form and mark it as a security report. We won't pursue good-faith research that avoids privacy harm and service disruption.
Security questionnaires
This page should answer most of a vendor security questionnaire. If yours asks something it doesn't, send it — we'll answer it directly and accurately.