Security
We run a mortgage company and a vacation rental business on the software we build, so we hold your data to the same standard as our own. Here is what we do, in specifics, and what we don't claim.
The apps we build run on Supabase, a managed Postgres database, and Netlify for hosting. Both publish how they encrypt data.
Sources: Supabase security and Netlify security.
Permissions are enforced in the database itself with row-level security, not just hidden on the screen. In our mortgage company's app, real estate partners can see a borrower's contact details but never the money on a deal, and the database enforces that rule.
Roles are set per person, and viewers can get read-only access. In our own rental operations app, an intern signs in to a read-only database role that cannot change a single record.
Two-step sign-in is available in the apps we build: a passkey with Face ID or Touch ID, or a one-time code sent by email. The server checks it, so it can't be skipped by changing the page in a browser.
You choose which roles need it, and you can see who has enrolled.
From our client agreement:
"You always own your data and the content you give us."
"On request at any time, and when this Agreement or an SOW ends, we hand over the source code, documentation and admin access for work you have paid for. Wherever practical, service accounts are set up in your name."
Wherever practical, the code lives in your own GitHub account. At launch you get documentation and a runbook, so another developer could pick it up.
We use Claude through Anthropic's commercial products. Anthropic states that by default it does not use inputs or outputs from its commercial products to train its models.
Our agreement says it too: "We do not use your confidential information or your data to train AI models."
Sensitive information stays out of AI tools unless it is properly protected, and a person reviews anything consequential (money, legal, compliance, or messages to your customers) before it goes out.
Source: Anthropic privacy center. Claude is made by Anthropic. We are independent and not affiliated with Anthropic.
We sign a business associate agreement (BAA) with healthcare clients, and patient data stays on hosting and AI services that sign BAAs with us.
We're happy to sign a mutual NDA before your consultation. Confidentiality is also built into every agreement we sign: it is mutual, it lasts for 3 years after the agreement ends, and trade secrets and customer data stay confidential for as long as the law protects them.
We set up backups and test restores as part of every launch. A backup only counts once you have seen it come back.
If we learn of a breach affecting your data, we notify you within 72 hours.
We are a small, senior team, not a large vendor. We don't hold a SOC 2 report or other security certifications of our own, and we won't pretend to.
The services we build on publish their own security and compliance information, and we'll walk your team through exactly where your data lives and who can see it.
Tell us what your compliance team needs to see. We'll answer in writing, before any work starts.