Security & infrastructure

Systems we build run in your environment — your servers or approved cloud infrastructure, your credentials, your accounts. We don't operate a shared multi-tenant platform that your data passes through by default. If a deployment shape genuinely requires infrastructure we host, that's scoped and agreed explicitly, not the default.

Where our team needs temporary access to a client tool — a CRM, an outreach platform, an ad account — that access is scoped to what the specific system requires, and is removed at handover unless you ask us to retain it for ongoing support. We don't keep standing access to client systems after a project closes by default.

Every operating system we deploy is designed with a human approval step before any outward-facing action — a message sends, a post publishes, a sequence triggers — not as an optional add-on, but as the default shape of the systems themselves. That's reflected in how every system on this site is described, not just claimed here separately.

Every deployment includes runbooks and system documentation, so your team can operate, audit, and modify what was built without depending on us to explain it after the fact.

We're a small, specialist team, not a platform vendor — and we'd rather say that plainly than list certifications we don't hold. We do not currently hold a SOC 2 or ISO 27001 certification, and we haven't published a third-party penetration test report. Where a client's procurement process requires one of these, we scope it into the engagement rather than pretend it's already in place. If formal certification becomes a recurring requirement from clients, it's on our roadmap — this page will be updated the day that changes, not before.

If you've found a security issue with this site or with a deployed system, the fastest way to reach us directly is to book a call or reply to your existing engagement thread — we treat security reports as urgent regardless of how they arrive.