How we handle your systems and data

Draft. These commitments await approval by both partners. Bracketed items must be completed before launch.

Principles

Our clients trust us with production systems and the data inside them. These are the rules we work to on every engagement:

• Your data stays yours. It lives in your accounts and infrastructure, not ours.
• Minimum access. We ask only for the access a task needs, for as long as it needs it.
• Nothing leaves production without approval. We do not copy production data to other environments or devices without your written agreement.

Access and accounts

• Named, individual accounts for each partner. No shared logins.
• Multi-factor authentication wherever your systems support it.
• Least-privilege roles, raised temporarily for specific tasks where possible.
• All access is removed or handed back at the end of the engagement, and we confirm this in writing.

Handling production data

• We develop and test with synthetic or anonymised data by default.
• Where real data is unavoidable (for example to diagnose an incident), we access it in place, in your environment, and only what the task requires.
• Personal information is never pasted into third-party tools that you have not approved, including AI services.

Secrets and credentials

• Secrets are never committed to source code or shared over chat or email.
• We use your secret manager, or an encrypted password manager when you have none.
• Credentials are rotated when an engagement ends or a team member's access changes.

Devices and encryption

• Partner laptops use full-disk encryption, automatic screen lock and current operating system updates.
• Data in transit is encrypted (TLS). We recommend encryption at rest for every system we build or run.

Service providers we use

These are the third parties that may handle information as part of our own operations:

Incidents

If we suspect that your systems or data have been compromised, we tell you without undue delay, contain the issue, and help you meet your own obligations, including notifications under section 22 of POPIA.

Agreements

When we process personal information on your behalf, we act as your operator under POPIA and will sign an operator agreement or data processing agreement setting out these duties. We are also happy to work under your NDA.

End of an engagement

At the end of an engagement we hand back code, documentation, credentials and data, remove our access, and delete any copies we hold unless the law requires us to keep them. We confirm this in writing.