Careful with your data, start to finish.

How we protect your business

• Your data stays yours

  Each client’s work is kept separate from everyone else’s.

  • Your data stays in your own systems, or in a project set up just for you.
  • Nothing from one client’s work is ever used in another client’s.
  • We never sell or share your data.

• Passwords and keys

  Logins and keys are kept in encrypted secret stores, never written down where they could leak.

  • Never in code, email, chat or notes.
  • We never ask you to send a password by email or through a form.
  • Access is limited to what the job needs, and you can take it back at any time.

• Tested before it runs

  An automation earns the right to run on its own.

  • It runs in a sandbox against your real documents first, and you check the output.
  • It isn’t allowed to submit anything on its own until the output is right.
  • The first live runs are watched closely, and anything unusual goes to a person instead of being guessed at.

• Websites we host

  Every client site we host gets the same security setup, scoped to that site.

  • HTTPS everywhere, and browsers are told to never fall back to an insecure connection.
  • Eight security headers, including a content security policy written for that site.
  • Rate limits on forms that send email or save data, plus the hosting platform’s DDoS protection.
  • Site code kept in private repositories.

• Databases and payments

  The parts that hold records are locked down by default.

  • Databases behind our sites and automations only answer to the server, and their keys never reach a web browser.
  • Card payments run through Stripe. We never see or store your card number.

• You own it

  No lock-in.

  • Your domain stays in your name.
  • Once it’s paid for in full, your site and the custom work we built are yours.
  • If you ever leave, it comes with you.