Security and responsible AI

Careful access starts with a clear conversation.

Before we touch production, we agree what the project needs, what stays off limits and how data and access will be handled.

Access and secrets

Give the project only the access it needs.
Use named accounts and multi-factor authentication wherever the client system supports them.
Decide where secrets are stored and when project access will be removed.

Set the code-review and release checks before delivery begins.
Choose dependency, type and automated tests that suit the stack and its risks.
Keep test and production settings separate and record the decisions that matter.

Decide which data can be accessed, where it can be processed and how long it can be kept.
Use representative or synthetic data when real records aren’t needed for testing.
Record the providers, data locations and deletion requirements involved.

Check model providers against the use case and its data limits.
Keep source information, model output and human decisions visibly separate.
Put evaluation and human review in place before any high-impact external action.

For procurement teams

We can complete a supplier questionnaire and discuss contractual terms, subprocessors, access, incident handling and handover.

Regulated, safety-critical or high-risk processing may need a specialist legal, compliance or security review.

Let’s talk

Tell us about the systems, data and controls involved. We’ll address them early.