Security
AI touching real operations has to hold up under scrutiny.
Here is how an engagement runs, what we refuse to build, what this website does with what you type, and how to tell us about a vulnerability. If your procurement team needs it in their format, ask.
Engagements
Five controls, in every statement of work.
- 01
Access
- Named accounts in your identity provider. No shared logins, ever.
- Scoped to the systems the phase needs, reviewed at each phase gate.
- Revoked at handoff, with a written list of what was granted and when it was removed.
- We never hold production credentials. Secrets live in your vault and are injected at runtime.
- 02
Data
- Work happens inside your cloud account or workspace. Not on our laptops.
- Samples we use locally are synthetic or anonymised, and we document how.
- Retention for anything we hold is written into the statement of work, with a delete date.
- An NDA is signed before the first byte. We will sign yours.
- 03
Models
- Commercial API terms only: no training on your inputs or outputs, by contract.
- If data cannot leave your boundary, we deploy open-weight models inside it.
- Every model, version, and provider in the system is inventoried in the handoff.
- Prompt and output logs stay in your environment, under your retention policy.
- 04
Before launch
- An evaluation suite of at least one hundred real cases, with pass thresholds agreed in writing.
- Prompt-injection and data-exfiltration test cases, re-run on every change.
- Human approval by default for anything that moves money, changes a record, or contacts a customer.
- A kill switch your team can flip without calling us.
- 05
In production
- Monitoring dashboards and runbooks are yours; your team is on the rotation, not ours.
- If we learn of an incident involving your data, you hear within twenty-four hours.
- A written post-incident report within five business days, including what we changed.
- Subprocessor changes are notified before they happen, not after.
Need a questionnaire answered?
SIG, CAIQ, or your own spreadsheet. We complete it, or send our standard security overview and data-processing terms.
What we will not build
Five things we say no to.
- 01
Systems that make a final call on credit, hiring, housing, or medical treatment without a human who can overrule them.
- 02
Anything that scrapes or ingests data you do not have the rights to use.
- 03
Covert monitoring of employees or customers.
- 04
Agents with the authority to spend, delete, or send on their own before an evaluation set says they are ready.
- 05
Projects where the client declines an evaluation set. We would rather not ship than ship blind.
None of these are hypothetical. Each one has come up in a scoping conversation, and each time the answer was the same. We would rather lose the engagement than put our name on a system we would not want pointed at us.
This website
What happens to what you type here.
- Idea generator inputs
- Text you type into the generator is sent server-side to Anthropic's API to produce suggestions and is stored with the output so we can review quality. It is not used to train any model. API keys never reach the browser.
- Contact requests
- Stored in a managed Postgres database with access limited to the firm. Used only to reply to you. Protected by a honeypot and rate limiting rather than third-party trackers.
- IP addresses
- We never store raw IP addresses. They are hashed one-way with a secret salt before anything is written, so they cannot be reversed.
- Analytics and cookies
- Usage analytics are first-party and cookieless. Advertising cookies are set only if you accept the consent banner, and the site works identically if you decline.
The full detail is in our Privacy Policy.
Subprocessors
Who else touches website data.
| Provider | Purpose | Region |
|---|---|---|
| Vercel | Hosting and serverless compute | US |
| Neon | Managed Postgres for contact requests and generator logs | US |
| Anthropic | Model inference for the idea generator | US |
Engagement subprocessors depend on your stack and are listed in each statement of work. We add nothing to that list without telling you first.
Responsible disclosure
Found something? Tell us.
If you believe you have found a vulnerability in this website or in a system we built, send it through the form below with enough detail to reproduce it. We acknowledge reports within two business days and keep you informed until the issue is resolved.
We ask that you give us reasonable time to fix the issue before disclosing it, avoid accessing or modifying data that is not yours, and do not run denial of service or social engineering tests.
Machine-readable contact details are published at /.well-known/security.txt.