Security & IP Protection

• Mutual NDA executed before deep technical discovery.
• Need-to-know access to docs, repos, environments.

• Client owns all work product and derived IP upon payment (MSA + SOW govern).
• Permissive OSS (MIT/Apache-2/BSD) may be used with explicit approval; NOTICE files preserved.
• No copyleft dependencies introduced without written approval and legal review.
• We maintain third-party attributions in a /NOTICE or /THIRD_PARTY file as applicable.

• Least-privilege IAM. Role-based access via IaC (Terraform/CDK), peer-reviewed changes.
• Segregated dev/stage/prod accounts or environments; separate credentials and policies.
• MFA required; keys rotated; no long-lived credentials in CI.
• Secrets in managed stores (e.g., AWS Secrets Manager/SSM). Never in code or tickets.

• PII logically separated; encryption in transit (TLS) and at rest (KMS/managed keys).
• Data minimization in lower environments (masked or synthetic fixtures).
• Audit logs retained; sensitive fields redacted at source or via processors.
• Backups with tested restore procedures; RPO/RTO targets documented in runbooks.

• SLOs defined for availability/latency/error rate; dashboards and alerts routed to on-call.
• Runbooks maintained; post-incident reviews with action items and ownership.
• Change management via PRs, CI checks, and deployment approvals.

• No training of third-party models on client proprietary data without written approval.
• RAG pipelines: content stays within approved storage; access enforced by app-level authZ.
• Model/vendor selection documented (capabilities, regions, data retention, egress).
• PROMPT/response logs scrubbed for PII/secret material before persistence (if any).

Typical vendors: GitHub (source), AWS (infra), Cloudflare/New Relic (if applicable). Additional vendors require prior approval, documented purpose, region, and data classification. Access scoped per environment.

• Access revoked via IaC and SSO; tokens rotated; service users disabled.
• Assets delivered: source code, infra state, design files, diagrams, runbooks, credentials via sealed channel.
• Optional security/architecture review and knowledge-transfer session.