Security & data handling
How I handle your systems and data
I work inside production environments, so this is how I keep that access small, visible, and easy to take back. It describes how I work today. It is not a certification, and the signed agreement for your engagement is what governs.
Before I touch anything
- I sign your NDA on request before any access is granted or any internal material changes hands.
Access and credentials
- I ask for least-privilege access: credentials scoped to the systems in the agreed scope, and time-boxed where your tooling allows it.
- The access I hold is revoked at handoff.
- Secrets live in your vault or secret manager. They are never committed to repos, pasted into tickets, or kept in my own notes.
Your infrastructure, your accounts
- Where possible, everything is built in infrastructure and accounts you own: cloud projects, model provider accounts, repos, and monitoring.
- That way nothing important is stranded in an account of mine when the engagement ends.
Models and data boundaries
- Your data is never used to train models.
- We choose the boundary that fits your data: a frontier model API with zero-retention settings where the provider offers them, a private deployment in your VPC or on your own hardware, or a hybrid route that keeps sensitive work private and sends the rest to a frontier model.
- The choice, and the reasons for it, are written down so your team can review it.
Agents with infrastructure access
- Changes run as a dry run first, so you can see what would happen before anything does.
- Actions that change real systems wait behind an approval gate.
- Every action an agent takes is written to an audit log you can read.
Handoff
- You get written handoff docs: the architecture, runbooks, and the decisions behind them.
- The goal is that your engineers can own and operate the system without me.
Have a security questionnaire?
Send it over before we start. I would rather answer it properly up front than discover a mismatch halfway through.
Please don't send passwords, API keys, or sensitive records through the contact form or the chat assistant. We will set up a proper channel, usually your own vault, once we agree to work together.