What we apply on every project, and what we do not claim

On every project

• Multi-factor authentication on every account we hold for a client, including cloud consoles, repositories and email.
• Least-privilege access per person and per environment; credentials are never shared between clients.
• Access removed within one business day when a team member leaves a project.
• Role-based access and audit logging designed into the applications we build.

Scoped per engagement

• Single sign-on with your identity provider (Microsoft Entra ID, Google Workspace, Okta).
• Client-managed keys and secrets vaults.

On every project

• Encryption in transit (TLS 1.2 or higher) and at rest for databases, storage and backups.
• Daily backups with a documented restore procedure.
• Data minimization: we collect and keep only what the system needs, with retention rules agreed with you.
• Production data is not copied to laptops or used in development without anonymization and written approval.

Scoped per engagement

• Field-level encryption for especially sensitive records.
• Customer-managed retention and legal-hold requirements.

On every project

• Hosting in your own cloud or hosting account, in your name, so you are never locked to us.
• Hardened servers and containers: unprivileged processes, firewalling, automatic security patching, monitoring and alerting.
• Canadian data residency available: AWS Canada (Central) for compute, databases, storage and backups.

Scoped per engagement

• Private networking, VPN or client-managed infrastructure.
• On-premises or sovereign-cloud deployment.

On every project

• Code review on every change, with automated tests and dependency vulnerability scanning in the pipeline.
• Secrets kept in managed stores, never in source code.
• Separate development, staging and production environments; nothing reaches production without passing staging.
• Accessibility (WCAG 2.1 AA target) and performance checks as release gates.

Scoped per engagement

• Third-party penetration testing before launch.
• Static analysis and software bill of materials for regulated clients.

On every project

• Model providers used on business or API terms that do not train on your data; confirmed in writing for your chosen provider.
• Human approval for consequential actions: anything that sends to a customer, moves money or changes a record of importance.
• Logging of what the AI did, what it processed and what it skipped, so results can be audited.
• Evaluation on your real cases before launch and sampled review in production.
• Model independence: one router, so the provider can change as models improve.

Scoped per engagement

• Private or regional model hosting for sensitive content.
• Data loss prevention rules on what may be sent to a model.

On every project

• Designed to PIPEDA, and to PHIPA and CASL where they apply, with privacy decisions documented.
• AODA and WCAG 2 accessibility on every interface people use; AODA-trained team.
• Incident response: a named contact, investigation, and notification within the timelines agreed in the contract.

Scoped per engagement

• HIPAA-aligned handling for US health data (we have delivered analytics on anonymized health-insurance data under HIPAA).
• Privacy impact assessments with your privacy officer.

On every project

• A written scope and phased price before work starts; a review at every gate.
• Weekly progress updates and a demo of working software at least every two weeks.
• Documentation, runbooks and training at handover; your code in your repository.
• A named contact after launch with response targets set out in the contract.

Scoped per engagement

• 24/7 monitoring with on-call response.
• Service-level agreements with credits.