Vendor Pack

Professional liability insurance active. Implementing controls aligned with ISO 27001 (not certified). Certification roadmap available on request. GDPR-compliant data processing. All engineers sign NDAs before engagement. Security questionnaire (SIG Lite/CAIQ) available under NDA.

Data residency within EU by default. Data Processing Agreements (DPA) executed before engagement. Regular data handling audits. Documented retention and deletion policies. No client data used for training or analytics.

Mutual NDAs and DPAs available before any technical discussion. We are comfortable working within your legal framework or can provide our standard agreements reviewed by enterprise legal teams.

Full transparency on subprocessors and third-party tools. Current subprocessors include: cloud infrastructure (AWS/Azure), project management (Jira/Linear), communication (Slack/Teams), and version control (GitHub/GitLab). Complete list provided upon request.

• Commercial response SLA: under 24 hours.
• Onboarding SLA: engineers integrated in under 2 weeks.
• Reporting cadence: weekly status, monthly executive, quarterly business review.
• Incident response: defined severity levels with escalation paths.

Client references available on request under NDA. We can provide references from engagements in banking, cybersecurity, and hospitality sectors.