The answers to your security questionnaire, before you send it.
Everything below is what we would put in writing during procurement. Three of the rows say we do not hold something. Those rows are the reason to believe the other nine.
Answers, in the form procurement asks for them.
If a question you need is not here, ask it. We would rather answer it now than in week three of a security review.
- Do you train models on our data?
Never.
No client content is used to train or fine-tune any model, ours or a provider's, and none of it enters a shared evaluation set. Where a model provider is in the path, we configure the account so your content is not retained for training.
- Can retrieval run inside our tenancy?
Yes.
The whole retrieval stack is self-hostable: PostgreSQL with pgvector, the embedding pipeline and the API can run in your cloud account or your data center. In that arrangement your documents never leave your infrastructure and we work through access you grant and can withdraw.
- Will you sign a DPA?
Yes.
We will sign yours, or provide ours if you would rather start from a draft. Standard Contractual Clauses where an EU transfer is in scope, and a named point of contact for data-subject requests.
- Encryption in transit and at rest
HTTPS only. At rest, see the note.
This website is served over HTTPS exclusively, with TLS negotiated by the hosting platform. It holds no client data at rest: the pages are statically generated, there is no database and no object storage, and an enquiry is delivered to us as email rather than stored here. For an engagement, encryption at rest is a property of the deployment we build with you, so we state the exact configuration in that engagement's architecture document instead of asserting a blanket standard here. Where we build inside your tenancy, the keys and the configuration are yours.
- Subprocessor list
Published, not on request.
The full list is at /legal/subprocessors: every third party, what it actually receives rather than a category, the processing region, and whether it is active today. It also names the integrations that exist in the code but are switched off, because what could switch on without a code change is part of an honest answer. If the list changes during an engagement, you are told before the change takes effect.
- Where is client data processed?
In the region you specify.
Fixed in the contract before anything moves. For a self-hosted deployment the answer is simply your own infrastructure, which is the arrangement most regulated buyers end up choosing.
- How long do you keep it?
For the engagement, then it is deleted.
Working copies are destroyed at completion, or earlier if you ask, and we confirm deletion in writing. We do not keep a corpus after the work is finished, because holding data we no longer need is a liability for both of us.
- Who on your side can access it?
Named engineers only.
Least-privilege credentials issued to the specific engineers on your engagement. No shared accounts, and every credential you issue is one you can revoke without calling us first.
- Do you publish or reuse client findings?
No.
We do not publish findings, reuse them as case material, or name you as a client without written permission. That policy is why this site names no clients and shows no logos.
- SOC 2 Type II attestation
Not yet held.
SOC 2 requires an attestation report issued by a licensed CPA firm. We do not have one, so we do not claim one. If your procurement gates on the Type II report, tell us on the first call and we will say plainly whether that is workable, rather than letting you find out at diligence.
- ISO/IEC 42001 certification
Not held. We deliver gap assessment and readiness, not certification.
Certification against ISO/IEC 42001 can only be issued by an accredited certification body. We are not one, and neither is any consultancy that tells you otherwise. What we do is the work before the audit: gap assessment, control design, evidence preparation and readiness review.
- Organizational ISO/IEC 27001 certification
Not held.
The ISO/IEC 27001 line on our credentials is personal training, not an organizational certification. Those are different things, and we will not let the wording blur to make the list look longer.
A previous version of this site claimed SOC 2 compliance. It was not true, it was removed, and this table exists so that class of error cannot happen again. Every claim on this site has to trace to something that exists today or it does not ship.
Not a compliance practice that learned security. A security practice that learned AI.
The security review is where most AI projects stall for months. It is where we start, because breaking systems is the work we did before we built them.
OWASP Top 10
Web and API testing follows it, including the parts that get skipped: access control between tenants, server-side request forgery from document fetchers, and everything that touches file upload.
MITRE ATT&CK
Findings are described as adversary behavior with a technique reference, so your security team can map them to detections they already run instead of translating our prose.
Read those figures narrowly
The 50-plus assets and the 65% reduction describe one program of government penetration testing that has already been delivered. They are past tense and they belong to that program. They are not a result we are promising you, because nobody can promise a percentage before seeing the estate.
What transfers is the method, not the number: the same testing discipline, applied to a system where the attacker’s input can now arrive inside a document your own retriever chose to trust.
What actually happens to what you send us.
Stated as operating practice, not as principles. Each of these is something you can hold us to in the contract.
We ask for the smallest sample that answers the question
Scoping runs on a representative sample, not your full corpus. A staging copy with realistic structure is usually enough, and many assessments never touch production data at all.
Your corpus can stay exactly where it is
Where the mandate requires it, the retrieval stack runs on your infrastructure and we operate against it through access you grant. Nothing is copied out for our convenience.
Nothing you send trains anything
Not our models, not a provider's, not a shared evaluation set. This is the question every regulated buyer asks first, and the answer does not have conditions attached.
Deletion is a line item, not a favor
Destruction of working copies is written into the scope with a date, and confirmed to you in writing when it happens. You should not have to chase it.
Credentials are scoped and revocable
Least-privilege access for named engineers, no shared accounts, and nothing that requires you to ask us before you can shut it off.
The report is yours, including the parts we would rather not write
Findings go to you, not to a marketing team. If the honest conclusion is that your system is in reasonable shape, that is what the report says.
What two weeks of testing covers.
An independent review of an AI system you already run, or one a vendor built for you. Five areas, tested against the system as deployed rather than as documented.
- 01
Prompt injection, including injection that arrives in your own documents
The interesting case is not a user typing 'ignore previous instructions' into a chat box. It is a contract, a claim file or a scanned PDF already sitting in your corpus that carries instructions the retriever hands to the model as trusted context. We test injection arriving through retrieved documents, tool output and uploaded files, not just through the input box.
- 02
Data exfiltration and tenancy boundaries
Whether the system can be steered into returning what the person asking is not entitled to: another tenant's documents, another matter's files, the system prompt, or secrets that leak sideways through tool output, error messages and logs.
- 03
Agent authority and blast radius
What the agent can actually do when it is wrong or steered: which tools, which credentials, which writes, how much spend. Then what stops it: kill switch, audit trail, scope and rate limits, and whether the human decision points that exist on the architecture diagram also exist in the code.
- 04
Application penetration testing around the model
The model is one component. Authentication, session handling, tenancy checks, the API surface and the ingestion pipeline are tested the way any web application is tested, because that is where most real findings still are.
- 05
Grounding, measured on your data
How often an answer is genuinely supported by the source it cites, scored against a set built from your own corpus rather than a public benchmark. You keep the harness, so the number stays measurable after we leave.
We audit AI systems. Here is this website, audited.
Most firms put a customer logo wall here. We have no named clients and will not borrow anyone else's credibility, so this is the substitute: the measured result of running our own gates against the page you are reading. Every one is reproducible, and the commands are in the repository.
| What was measured | Result | How to reproduce it |
|---|---|---|
| Horizontal overflow, every route at every device widthpnpm responsive | 0 of 1056 | pnpm responsive |
| Overflow hidden by a clipping ancestor, which the sweep above cannot seepnpm masked | 0 of 344 | pnpm masked |
| Pages that render fully with JavaScript disabledpnpm degradation | 43 of 43 | pnpm degradation |
| Pages with nothing left animating under prefers-reduced-motionpnpm degradation | 43 of 43 | pnpm degradation |
| Keyboard paths with a visible focus indicator and no hover-only contentpnpm degradation | 86 of 86 | pnpm degradation |
| Lighthouse accessibility, on four sampled routespnpm lighthouse | 100 | pnpm lighthouse |
| Exactly one h1 per page, and no skipped heading levelspnpm verify | 43 of 43 | pnpm verify |
| Internal links that resolve to a real routepnpm verify | 49 of 49 | pnpm verify |
| Published USD prices with no row in the claims registerpnpm verify | 0 of 45 | pnpm verify |
The point is not that these numbers are impressive. It is that they are checkable, and that we hold our own marketing site to the standard we would apply to your system. A firm that sells measurement and does not measure itself is asking you to take the one thing it sells on trust.
Three questions that decide whether this is a short conversation.
- 01
Does your procurement hard-gate on a SOC 2 Type II report?
If it does, say so first. We do not hold one and we will not waste your review cycle finding that out in week four.
- 02
Does the data have to stay inside your tenancy?
If it does, that is fine and it is the deployment we would suggest anyway. It changes the build, so it needs to be known at scoping.
- 03
Who signs off, and what evidence do they need?
A security architect, a DPO and a general counsel want three different documents. Knowing which one you need shapes what we produce.
Send us the questionnaire you send everyone else.
We will answer it in writing, including the rows where the answer is no. If a gap is disqualifying for you, we would both rather know in week one.
Typical reply within one business day · Engagements start at $2,500