Security and governance built to run
Production-grade delivery with right-sized controls—clear ownership, auditability, and disciplined change management that scales with risk.
Defaults: client-hosted by default, no training on client data by default, controls and evidence scale with risk.
Controls at a glance
A compact view of the control domains we build into production systems. Controls are right-sized to risk and fit your operating model.
Identity & access
Least privilege and clear ownership for humans and services.
- SSO/MFA
- RBAC/ABAC patterns
- Managed identity where supported
Data protection
Data handled with explicit boundaries and strong defaults.
- TLS 1.2+ in transit
- AES-256 at rest
- Secrets in vaults / CMK where required
Network & isolation
Private connectivity and segmentation aligned to your environment.
- Private networking where required
- Ingress controls
- Egress-aware design
Secure delivery
Build pipelines that produce signed, traceable artefacts.
- Immutable CI/CD
- Signed artefacts
- SBOM per release (where applicable)
Observability & audit
Systems you can operate and investigate with confidence.
- Centralised logging
- Metrics + alerting
- Audit events for key actions
Governance & change control
Versioned changes, explicit approvals, and rollback discipline.
- Versioning
- Release/rollback
- Change control aligned to risk
Delivery governance
Governance is part of delivery, not an afterthought. We define controls up front, ship with operational readiness, and iterate with disciplined change.
How we run engagements
Clear stage gates and crisp acceptance criteria.
- Stage gates aligned to risk tier
- Explicit acceptance criteria per deliverable
- Decision logs for material changes
- Rollback and reversibility planned upfront
Assess
Define scope, constraints, and control posture before any build starts.
- Workflow discovery
- Baseline KPIs
- Risk tier + controls
- Delivery plan
Build
Ship production capability and the controls needed to operate it safely.
- Acceptance criteria
- Security checks in CI
- Observability + audit events
- Runbooks + rollout
Evolve
Iterate with governed change and measured outcomes.
- Change control
- Regression checks
- Performance/reliability tuning
- Roadmap iteration
Responsible AI
We embed AI where it materially improves throughput, quality, or decisions—then govern it as a production component.
Default posture
Clear defaults; opt-in where required.
- Client-hosted by default
- No training on client data by default (opt-in only)
- Versioned prompts/models
- Controls scale with risk tier
Risk tiering
Controls scale with impact: low-risk assistive flows differ from high-risk decisions.
- Define intended use + boundaries
- Assess failure modes
- Right-size controls
Human oversight
Approvals and review where the workflow requires it—especially for higher-risk outputs.
- Human-in-the-loop gates
- Clear escalation paths
- Separation of duties where needed
Evaluation & regression
Repeatable checks to prevent silent quality drift across updates.
- Golden test sets
- Quality thresholds
- Regression checks in CI
Monitoring & auditability
Runtime behaviour is observable and traceable for investigation and compliance.
- Logging + metrics
- Audit events
- Feedback loops
Evidence pack
We keep claims conservative. Evidence is provided as documents and artefacts aligned to what we actually ship and operate.
What you’ll receive
A practical set of artefacts for stakeholders and reviewers.
- Architecture overview aligned to deployment
- Controls summary (right-sized to risk tier)
- Data handling notes (residency, retention, access)
- Operational readiness notes (logging, alerting, runbooks)
Items marked “as applicable” depend on scope, risk tier, and your internal requirements.
Contracting
Core documents to support procurement and governance.
- MSA/SOW templates
- DPA (where required)
- Subprocessor register (as applicable)
Delivery artefacts
Operational and release artefacts produced during delivery.
- Release notes + versioning
- Change control notes (where applicable)
- SBOM per release (where applicable)
- Reversibility / exit steps (where applicable)
Compliance alignment
We design for common frameworks without claiming certifications unless confirmed.
- ISO 27001 (design-aligned)
- SOC 2 (design-aligned)
- GDPR (where applicable)
- NIST AI RMF / ISO/IEC 23894 (RAI alignment)