How we handle your data, and who owns what we build.

Data handling

We process personal and business data in line with UK GDPR and the Data Protection Act 2018. The full detail is in our Privacy Policy. In practice, for a client engagement that means:

• Access controls and encryption in transit and, where appropriate, at rest.
• Client data used only to deliver the engagement it was provided for, never to train shared models.
• Sub-processors (hosting, AI model providers) engaged under written terms, disclosed on request.
• A written data processing agreement wherever we act as a processor on your behalf.

Deployment options

Most engagements run on our own infrastructure. Where a client's policy requires it, most commonly for internal-knowledge deployments like Vault, we can deploy inside your own environment instead. Tell us the constraint and we'll tell you honestly whether we can meet it.

Ownership

You own the deliverables built specifically for you, once fees are paid in full. We retain our own methodologies, frameworks and general know-how: the tools we build with, not the thing we build for you. Full terms are in our Terms of Service, Section 8.

Certifications

We don't currently hold a third-party security or AI-governance certification. It's an open item we're evaluating, not a claim we're making.