GDPR and DPA
We sign a data processing agreement when personal data is involved. Processing is limited to the purpose you define.
How We Work With Data
The rules apply to every project, not only to regulated industries.
NDA before access
Confidentiality is signed before we see code, credentials, or customer data.
Least privilege
Each engineer gets only the access needed for the task. Access is removed when the work ends.
Data minimization
We do not copy production data to local machines. Test data is synthetic or anonymized.
Secure development
Input validation, prepared queries, nonce and capability checks, escaped output, dependency review.
AI data rules
Client data is not sent to public AI tools without written approval. RAG systems run on your infrastructure or a private environment.
Documents We Sign
Standard paperwork for an outsourcing engagement.
Before work
- Mutual non-disclosure agreement
- Service agreement with scope and milestones
- Data processing agreement, when personal data is processed
- Security and access policy addendum
- Subprocessor list, on request
At handover
- Source code and repository transfer
- Third-party license list
- Deployment and environment notes
- Data deletion confirmation
- Architecture and operations documentation
Data Handling in Practice
Project data lives in the client’s systems wherever possible. When we need a working copy, it stays in an access-controlled environment with named users, and it is removed at the end of the engagement. Backups are encrypted, and credentials are stored in a password manager rather than in documents or chat.
For AI features, we separate the model from the data. Retrieval indexes are built from documents you own, hosted in your environment or in a private cloud account. We do not use client content to train public models. Prompts and answers can be logged for quality control only when the agreement allows it.
We are a Ukrainian individual entrepreneur, not a certified ISO or SOC 2 organization. If your procurement requires a certification we do not hold, we say so before the contract, not after.
Questions & Answers
Procurement and security questions we receive most.
Are you GDPR compliant?
We work under GDPR principles and sign a DPA with EU clients. Compliance also depends on your own processes and on where data is hosted, so we document our part clearly.
Where is the team located?
In Ukraine. We work remotely with clients in Europe, the United States, and Asia, and agree on overlap hours before the start.
Can you work inside our infrastructure?
Yes. We can work in your repository, your cloud account, and your ticketing system, under the access rules you set.
Do you use AI tools on client code?
Only with written approval. When allowed, we use tools with no training on client data and keep sensitive files out of the context.
What happens to data after the project?
Access is revoked, working copies are deleted, and we confirm deletion in writing. Source code and documentation stay with you.