What we ask for
| Stage | Access |
|---|---|
| Qualifier | Nothing. Never send passwords, API keys or your service_role key in a form or email. |
| Readiness Review | Read access to the repository and a read-only database role, ideally on a staging project. |
| Graduation | Permission to open pull requests, and access to a staging project to apply and test fixes. |
| Guard | Read access to new pull requests and releases. |
How each kind of information is handled
- Code. Read from your repository. Changes only as pull requests that you review and merge.
- Schema. Tables, policies, functions and storage rules are tested in a disposable database built from your migrations and seeded with test data. It is deleted after delivery.
- Production customer data. We don't export it and we don't need it to test access rules. If something can only be checked against production, we agree what and how in writing first and use a read-only role.
- Test data. Synthetic users, businesses and records we create, like "Patient A" in the sample report.
- Secrets. We never ask for your service_role key or passwords. If we find an exposed secret, we tell you to rotate it and we don't use it.
- AI tools. We use AI tools to read code and schema, generate checks and draft fixes. If your contracts restrict which tools or regions may process your code, tell us and we agree the setup before you grant access.
After delivery
- We remove our access and confirm in writing which access was removed. You can also revoke it yourself at any time.
- Disposable test databases are deleted.
- The code, the fixes and the controls are yours. There is no license, lock-in or ongoing fee unless you choose Readiness Guard.
- A mutual NDA is available on request before you share anything.
What this is not
This is a technical policy for how we work, not a compliance certification. If your app is subject to HIPAA, GDPR or similar rules, your obligations stay with you and your legal advisers; we can tell you which technical controls we tested.
Questions
Write to [email protected]. We reply within one business day.