Our commitments
Your data stays in your accounts
Automations run in cloud accounts and subscriptions you own. We do not copy your data into systems we control.
Least-privilege access
Each automation uses a dedicated service account with only the permissions it needs. Our own access is individual, logged and removed at the end of an engagement.
AI providers that do not train on your data
We use business API and enterprise offerings whose terms exclude training on customer data, with retention configured to your requirements.
Full audit trail
Every automated action is logged with inputs, outputs and timestamps, so you can answer "what happened and why" for any record.
Secrets managed properly
Credentials are stored in a secrets manager or the platform's encrypted store, never in code, spreadsheets or email.
Confidentiality
We sign your NDA or provide ours before receiving any sample data, and delete samples on request.
Privacy law
We design data flows to support your obligations under applicable privacy laws, including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Law 25 where relevant, and US state privacy laws. Where personal information is processed, we document what is processed, where and by which provider, so you can include it in your own privacy records.
Where you need data to remain in a specific country, we choose providers and regions that support it, and tell you where that is not possible.
What you control
- Which systems we can accessYou create and revoke every account we use.
- Which AI providers are usedApproved by you before anything is built.
- What runs unattendedYou decide which steps need human approval.
- How long data is keptRetention configured to your policy.
Data handling at a glance
A summary of where your data lives at each stage.
| Stage | Where data lives | Who can access it |
|---|---|---|
| Assessment samples | A restricted, encrypted project folder | The named people on your project |
| Build and testing | Your test or sandbox environments | Our team through individual, logged accounts |
| Production | Your systems and cloud accounts | Service accounts with least-privilege permissions |
| After the engagement | Your systems only | Your team; our access is removed |
Common questions
Can you complete our vendor security questionnaire?
Yes. Send it with your inquiry and we will complete it as part of the assessment.
What happens to our data when the engagement ends?
Our access is removed, any sample data we hold is deleted, and we confirm this in writing on request. The automations and their data remain in your accounts.
Find out what one process could save you
Book a paid automation assessment. We map the process with your team, measure the time it takes, and give you a fixed-price build plan with expected savings. If automation is not worth it, we will tell you.