Security & IP
Your ideas, code and data stay yours
Confidentiality, IP ownership and security aren't add-ons. They're built into how we contract, code and hand over every project.
Our commitments
Six promises in every engagement
NDA before we talk details
We sign your NDA or ours before you share anything confidential. Every team member is bound by confidentiality obligations.You own 100% of the IP
All source code, designs, documentation and assets created for your project belong to you. Ownership is written into every contract.Code in your repositories
We commit to GitHub, GitLab or Bitbucket repositories owned by your organisation from day one, so you always have the latest code.Your cloud, your data
Production runs in cloud accounts you own (AWS, Google Cloud, Azure or Vercel). We work with delegated access you can revoke at any time.Least-privilege access
Only the people working on your project get access, only to what they need, and it's removed when they roll off.Full handover, no lock-in
At any point you can take the product in-house or to another vendor with complete code, credentials and documentation.
Secure development
Security practices we follow
Applied on every project, scaled to how sensitive your product and data are.
- Secure coding aligned with the OWASP Top 10
- Peer code review on every change
- Automated dependency and vulnerability checks
- Secrets kept in environment variables or secret managers, never in code
- HTTPS everywhere and encryption of sensitive data at rest
- Role-based access control and audit logs in the apps we build
- Separate development, staging and production environments
- Anonymised or synthetic data for testing where possible
- Regular backups with tested restore procedures
- Security review before every major release
Compliance
Built to support your compliance
We design and build products that help you meet regulatory requirements, and work alongside your legal and audit teams.
India DPDP Act, 2023
Consent flows, privacy notices, data minimisation and user-rights features for products handling personal data of Indian users.GDPR
Consent management, data export and deletion, and data-processing documentation for products serving EU and UK users.HIPAA-ready builds
Access controls, audit trails, encryption and hosting on HIPAA-eligible cloud services for healthcare products.PCI-DSS scope reduction
Payments via PCI-compliant gateways (Razorpay, Stripe, PayU) so card data never touches your servers.
Handover
What you get at handover
Whether the project ends or you bring it in-house, you leave with everything needed to run and evolve your product.
- Complete source code in your repository
- Architecture and technical documentation
- Admin credentials and access for every service
- Deployment and environment setup guides
- Design files (Figma) and brand assets
- Knowledge-transfer session with your team
FAQ
Security & IP FAQs
Will you sign our NDA?
Yes. We're happy to sign your NDA before any detailed discussion, or share our standard mutual NDA if you don't have one.
Who owns the code and designs you create?
You do. Full intellectual property rights for all work created for your project transfer to you, as set out in our services agreement.
Can I move to another team later?
Yes. Because code lives in your repositories and runs in your cloud accounts, you can switch at any time. We'll provide documentation and a handover session.
Are you certified for HIPAA or PCI-DSS?
Certification applies to your organisation and product, not the development partner. We build with these requirements in mind (encryption, access controls, audit trails, compliant providers) and support you and your auditors through the process.
How do you handle our users' personal data?
We access production data only when necessary and with your approval, use anonymised data for testing where possible, and follow the data-protection terms in our agreement and India's DPDP Act.
Discuss your project in confidence
Book a free consultation. We'll sign an NDA first if you'd like, then talk through your idea.