Trust center
Security, privacy and responsible AI, in practice
Enterprise buyers check these things first. These pages set out how we work in engagements, in plain terms.
In short
These pages describe how we handle security, data privacy and AI in client work. We aim for least privilege, can work in accounts and code you own, can sign an NDA on request, and keep a person in the loop for the AI systems we build. Where an engagement needs it, our work can align with recognized frameworks. Alignment is not certification.
Last updated
01 About these pages
What are these pages?
These pages describe how we work in client engagements: the practices we aim to follow. They describe how we aim to work, and the specifics are agreed for each engagement.
The controls in each engagement follow the sensitivity of the data, the business impact, how exposed the system is, the contract and the laws that apply.
02 Commitments
What can you expect from us?
- Least privilege. We aim to ask only for the access a task needs and to remove it when the work ends.
- Your accounts and your code. We can work in cloud accounts and repositories you own, with the code documented so your team can run it.
- NDAs on request. We can sign a non-disclosure agreement before you share anything sensitive.
- AI with human review. In the AI systems we build, human oversight is part of the design, and consequential actions should need human approval.
03 Frameworks
Which frameworks do we align with?
Where an engagement needs it, solution design and implementation can align with recognized frameworks.
Alignment and implementation support are not certification, independent assurance or regulatory approval. We do not claim any certification.
- Controls aligned with ISO/IEC 27001 for information security
- Controls aligned with ISO/IEC 42001 for AI management systems
- Practices aligned with the NIST Cybersecurity Framework
- Risk work aligned with the NIST AI Risk Management Framework
- Controls aligned with the SOC 2 criteria, where applicable
- The privacy and sector rules that apply to your engagement
04 In this center
Where can you read more?
- How we keep the work secure Security is part of how we design and deliver, not a step at the end. This is what it means in an engagement.
- How we handle your data We use as little of your data as the work needs, agree how it is handled before we touch it, and aim to give up our access when the work ends.
- How we build AI responsibly We use AI where it helps, test it before anyone relies on it, keep people in charge of consequential decisions, and say so when AI is the wrong tool.
- Report a security vulnerability If you believe you have found a security issue in one of our sites, please tell us privately.