Your code, data and keys,
handled as if they
were ours.
Named and approved people, least privilege, vaulted secrets and a written handback when the work ends. Nothing here is a promise you cannot check.
Commitments
Six rules for every
engagement.
Each commitment comes with what to verify, so you can check it rather than take our word for it.
Named, approved people only
Everyone with access to your systems is a named person you have approved. We do not share logins between engineers.
What to verify: The list of names with access, matched against your own approvals.
Least privilege, time-boxed
Access covers only the systems the work needs, for as long as the work needs it. Broad or standing access is not requested.
What to verify: Scope and expiry dates on the credentials we hold.
Secrets stay in a vault
Keys, tokens and passwords live in a managed secret store. Never in code, chat, prompts or logs.
What to verify: No secrets in repository history or log output.
Your data stays yours
We do not use your data to train models and we do not share it with other clients. Any third-party tool that touches your data is named and approved by you first.
What to verify: The approved tool list, and nothing else in the data path.
Managed devices, MFA everywhere
Steinn engineers work from managed devices with disk encryption, screen lock and multi-factor authentication on every account.
What to verify: MFA enforced on the accounts we use.
Access ends when the work ends
When an engagement ends, we revoke every credential, remove our access and confirm it in writing.
What to verify: A dated confirmation listing what was revoked and when.
The boundary
What crosses the
gate, and when.
Your written approval opens the gate. Nothing crosses it on our initiative alone.
With your written approval
Production access, customer data, billing systems, infrastructure changes, and any third-party AI tool that would see your data.
Never without asking
We do not export customer data, add new services that touch it, or connect AI features to data sources you have not listed.
Day to day
How the work
is carried.
The habits behind the commitments, visible in your own tools.
- Where work happens
- In your repositories, your cloud accounts and your issue tracker, wherever you already work. We do not mirror your code to our own infrastructure without asking.
- Code and review
- Every change goes through a pull request with review. No direct pushes to production branches.
- Environments
- Development, staging and production are separate. We test against staging data, not copies of production personal data.
- Logs
- We keep personal and sensitive data out of logs. Where something must be logged to debug it, it is redacted or short-lived.
- AI assistants
- AI coding assistants used on your code are agreed with you in advance. We do not paste customer data into AI chat tools.
- Incidents
- If something goes wrong, you hear it from us first: what happened, what data was involved and what we changed.
When it ends
Handback, in
three steps.
Revoke
Every credential, token and key we held is revoked or expired. Shared accounts are removed from our engineers.
Return
Documents, exports and copies we made during the work are returned to you or deleted, as you choose.
Confirm
You receive a written list of what was revoked and deleted, so your own audit has the record.
Before we start.
Where does our code and data live?
In your own accounts: your repositories, your cloud, your trackers. We ask before anything is copied anywhere else.
Do you use AI tools on our code?
Only the ones you approve. We agree the tool list before work starts, and we do not paste customer data into AI chat tools.
Do you train models on our data?
No. Your data is used to build and run your systems, not to train models, for anyone, including us.
Who can see our data?
Only the named Steinn engineers you approved, each with the least access the work needs. The list is short and you can see it.
What happens to access when we stop working together?
We revoke every credential, return or delete what we hold and send you a written confirmation, so your own records stay complete.
Can you sign our NDA and security questionnaire?
Yes. Send it over and we will complete it. We can also work inside your own security tooling where you prefer.
What if something goes wrong?
You hear it from us first: what happened, what was affected and what we changed. We agree the reporting process with you at the start.
The next step
Bring the rules
you work by.
Tell us what you're building and the security rules it has to meet. We'll work to yours, and show you how we'd prove it.