Security and your data
Last updated: 26 October 2026
To build something useful, we usually need access to your systems and some of your data. This page explains how we look after it.
Everything runs on your own accounts
What we build lives in accounts that belong to you: the hosting, the databases, the AI services and the code itself. You hold the keys and can see everything at any time. If you stop working with us, it all stays with you.
AI never learns from your data
We only use AI models (such as those from OpenAI, Anthropic and Google) through business and API accounts, under terms where your data is not used to train their models.
Where your data is kept
By default, we host your data in UK or EU regions. We only use other locations if you agree first. Some AI providers process requests in the United States; where that applies, we tell you before we start, and transfers are protected by the safeguards the law requires, such as the UK and EU adequacy arrangements for the US or standard contractual clauses.
Who can access it
- Every engagement is led by Afonso personally.
- Specialist engineers who work with us sign confidentiality and data processing agreements before they see any client data.
- We only access what the job needs, using named accounts rather than shared logins.
- You can remove our access at any time, and we remove it ourselves when the engagement ends.
How we build
The work you don't see is most of the work: passwords and keys kept out of the code, access limited to what each part needs, automatic tests, error monitoring, backups and documentation. Every month, the report shows you what was done.
Your contract covers it
For your business data, you stay in control and we act on your instructions. Every engagement includes a data processing agreement under the UK GDPR and the EU GDPR, with the list of providers we use for your work.
If something goes wrong
If we become aware of a security incident affecting your data, we tell you within 48 hours, explain what happened and help you deal with it, including any notice you need to give the regulator.
When we stop working together
We hand everything over, remove our access and delete any copies of your data we hold, unless the law requires us to keep something.
Questions
If your team, your IT provider or your clients have questions about how we handle data, email [email protected]. For personal data collected through this website, see our privacy notice.