Security

Security

We build fixed-scope pilots and modules with least privilege and clear boundaries in mind.

Defaults we work from

• No secrets, API keys, or credentials in browser / client-side code
• Model keys and tool credentials stay server-side or gated
• HTTPS assumed for production handoff endpoints
• Where it matters, acceptance includes refusal and failure-path checks

This website

• Pages are served over HTTPS with a content security policy, HSTS, and related browser headers
• No analytics or advertising scripts, and fonts are self-hosted
• Card payments happen on Stripe. This origin does not collect card numbers
• Stripe webhooks are checked with a signing secret on the server. That secret is not in the public site

What we don’t claim

Fixed packages don’t include compliance certifications, penetration-test reports, or regulated-industry attestations. HIPAA/clinical work and regulated finance systems of record are outside what we take on. This page is not a penetration-test report.

Report an issue

If you think you’ve found a security issue on this site or in something we delivered, email [email protected] with details. See also Privacy.