Security and compliance
Security by design. Compliance by default.
We do not only build systems for clients, we operate them in production. Your data, your compliance and your uptime are our direct responsibility, and we treat that trust as an engineering requirement, not a checkbox.
NDA signed before day oneNo architecture, codebase or data is reviewed until the mutual NDA is executed.
01Compliance posture
What we commit to, stated plainly.
Where a standard is met, the table says so. Where we follow a framework without holding its certificate, the table says that too.
| Area | What we do | Status | Evidence |
|---|---|---|---|
| NDA first | A mutual NDA is signed through our secure client portal before any architecture, code or data is shared. Signing takes under five minutes. | In place | Mutual NDA, digital signing |
| GDPR | We act as a Data Processor under GDPR for client data. Client data is never shared with third parties without explicit written consent. | Compliant handling | DPA, Article 28 |
| SOC 2 | Engineering practices aligned to the SOC 2 Trust Service Criteria. Aligned, not certified, and we say so plainly. | Aligned, not certified | Certification on the roadmap, [timeline to confirm] |
| Encryption | TLS 1.3 on all endpoints in transit. AES-256 for data at rest. No plaintext storage of sensitive information. | In place | All endpoints |
| Data residency | Client systems deployed on AWS, GCP or Azure with configurable residency: US, EU (Frankfurt or Ireland) and IN (Mumbai). | Available | Chosen at engagement start |
| Least-privilege access | Production access is role-based and scoped to the minimum required. All access is logged. Credentials are rotated per engagement. | In place | Access log |
| Approval gates | Every consequential agent action waits at a gate owned by a named person. The agent proposes; the owner approves or declines. | In place | See the queue |
| Edge protection | Cloudflare WAF in front of our endpoints for DDoS and threat protection. | In place | Cloudflare WAF |
| Penetration testing | Available for regulated-industry engagements. | On request | Scoped per engagement |
02Security controls
Six controls, every engagement.
The same controls apply whether we are reviewing your code in week one or running your system in year three.
Encryption in transit and at rest
All client data is encrypted with TLS 1.3 in transit and AES-256 at rest. No plaintext storage of sensitive information under any circumstance.
- In transit
- TLS 1.3, all endpoints
- At rest
- AES-256
NDA-first engagement
Every engagement begins with a signed mutual NDA before any architecture, data or code is shared. Our digital NDA portal gets this done in under five minutes.
- When
- Before the first working session
- Time to sign
- Under 5 minutes
Data residency options
We deploy client systems on AWS, GCP or Azure with configurable data residency, so data is processed where you say.
- Regions
- US, EU (Frankfurt, Ireland), IN (Mumbai)
- Clouds
- AWS, GCP, Azure
Access control and least privilege
Production access is role-based and scoped to the minimum permissions required. All access is logged, and credentials are rotated on a per-engagement basis.
- Model
- Role-based, least privilege
- Credentials
- Rotated per engagement
GDPR-compliant data handling
We act as a Data Processor under GDPR. A signed Data Processing Agreement is available for all EU and UK engagements, and we never share client data with third parties without explicit written consent.
- Role
- Data Processor
- Agreement
- DPA on request
Incident response
Confirmed security incidents are communicated to affected clients within four hours of discovery. We keep a written incident response runbook for every production system we operate.
- Client notice
- Within 4 hours
- Runbook
- Every system we operate
03Approval gates and audit trail
Agents propose. A named person decides.
Human in command.
Every consequential agent action passes an approval gate that a named person owns. Declined proposals are logged and returned to the agent. Every decision and every data access is written to the record as it happens, so your auditor reads what actually occurred.
The gate, as your operators see it
Every proposal waits for a person. Every decision leaves a record.
The queue is the control surface your risk and compliance teams review. The log is what your auditor reads. Both are built in, not bolted on later.
AI agents and automation04Evaluation before release
Nothing reaches production unchecked.
Every change passes the same four checks, in order. A failed check blocks the release and returns the work; it is never waived quietly.
A failing test, first
The test that proves the change is written before the change, and seen to fail. Then it is run again and seen to pass.
Secure code review
Every pull request is reviewed before merge, against the original request, not only against the diff.
Automated scanning
Static application security testing runs in CI/CD, and dependencies are scanned for known vulnerabilities on every build.
A gate that blocks
If anything that already worked has broken, the release stops. Model changes are evaluated against an agreed baseline [evaluation criteria per engagement].
Secure engineering practices
Built so it can be audited, then reproduced.
- 01Secure code review on every pull request before merge.
- 02Static application security testing (SAST) integrated in CI/CD.
- 03Dependency vulnerability scanning on every build.
- 04No client credentials in version control. Secrets are managed through environment vaults.
- 05Separate development, staging and production environments for every client system.
- 06Infrastructure as code, so all infrastructure is auditable and reproducible.
- 07Penetration testing available on request for regulated-industry engagements.
- 08Engineering practices aligned to the SOC 2 Trust Service Criteria.
05Incident response and disclosure
The clock starts at discovery.
Confirmed security incidents communicated to affected clients.
From discoveryPersonal data breach notified to the Controller, under the DPA.
From becoming awareAcknowledgement of every vulnerability report we receive.
Responsible disclosureCommitment to resolve confirmed vulnerabilities.
From confirmationResponsible disclosure
Found a vulnerability? Tell us first.
If you discover a security vulnerability in our systems, or in systems we operate on behalf of clients, report it to [security contact]. We acknowledge every report within 24 hours and commit to resolving confirmed vulnerabilities within 72 hours. A written incident response runbook exists for every production system we operate.
06Documents you can request
The paperwork, before the demo.
Procurement and security teams can have these at engagement start. Items marked as placeholders are not yet published.
Data Processing Agreement
GDPR Article 28. Sub-processor disclosure, data subject rights, breach notification and cross-border transfer safeguards. Countersigned copy returned within 48 hours.
AvailableRead the DPAMutual NDA
Signed through our secure client portal before any architecture, code or data is reviewed. Under five minutes.
AvailableStart with a briefingSub-processor list
AWS, Google Cloud, Microsoft Azure, MongoDB Atlas and Vercel, with purpose and location for each.
PublishedDPA, section 4Security questionnaire
Completed standard questionnaire [format to confirm, e.g. CAIQ or SIG Lite], or your own on request.
PlaceholderNot yet publishedArchitecture and security review
Written description of the target system: data flows, trust boundaries, residency and the approval-gate map [document to prepare].
PlaceholderNot yet publishedPenetration test summary
Testing is available on request for regulated-industry engagements [summary report format to confirm].
On requestScoped per engagementSOC 2 report
Not available. Our practices are aligned to SOC 2, not certified.
Not heldCertification on the roadmap07Security questions
Send your questionnaire, or your questions, to a named engineer.
Security and procurement questions go to the same senior engineers who would build and run your system. We reply within 48 hours.
08Legal pages
Privacy policy
How we collect, process and protect personal dataTerms of service
Use of the Algobain website and servicesData processing agreement
GDPR Article 28, for EU and UK engagementsCase study: a credit platform under approval gates
The controls above, in a production fintech system
Bring your security team to the first call.
We sign the NDA first, then answer their questions with the documents in hand.
- 1Within 48 hoursA senior engineer replies, not a sales desk.
- 2NDA, then a working sessionWe sign first. Your security team can join from the start.
- 3DPA at engagement startFor EU and UK entities, countersigned within 48 hours.