Trust center
Security and compliance, in writing
What procurement and IT teams ask before they share access, answered up front.
- Practice areas
- 4
- Practices in writing
- 13
- Code and IP are yours
- Day 1
What procurement asks, answered up front
Straight answers on contracts, code ownership, sign-off and support, with the details in writing.
Work that precisely hits the mark. Highly recommended team for dev work.
NDA as standard
A mutual NDA is signed before discovery starts.
You own all code
Code and IP are yours from the first commit.
Sign-off at every stage
Six delivery stages, each behind a gate you approve.
SLA-backed support
Response times by severity, written into the agreement.
Practices, in writing
Every practice below is part of how we work today. Ask for the policy behind any of them.
01 · 3 practices
Contracts
- Mutual NDA before discovery
- You own all code and IP from the first commit
- Data processing terms available on request
02 · 4 practices
Access
- Least-privilege access to client systems
- MFA on every account that touches client systems
- No production data on laptops
- Access removed at offboarding
03 · 3 practices
Secure development
- Code review on every change
- Dependency scanning in CI
- Secrets kept in a secrets manager, never in code
04 · 3 practices
Incidents and support
- Response times by severity in managed-service agreements
- Backups with tested recovery
- Written incident process
How we handle your data
Where it lives, who can see it, and what we will and won't claim.
- 01Where your data livesIn your cloud accounts and your platform, not ours. We work in your environments with access you grant.
- 02Who can see itOnly the engineers on your project, with the least access the task needs, removed when they leave it.
- 03Processing termsA data processing agreement is available for any project that touches personal data.
- 04CertificationsWe don't hold ISO 27001 or SOC 2 today and won't claim them before an audit. We answer your questionnaire instead.
If something goes wrong
Four steps, written down before we need them.
Detect
Monitoring and alerts on the systems we run, plus a single address for anyone to report a problem.
Phase 1 of 4
Contain
Access is cut or rotated first, then the cause is found. Production data never leaves your systems to investigate.
Phase 2 of 4
Notify
You hear from a named engineer without undue delay, with what we know, what we've done and what's next.
Phase 3 of 4
Review
A written post-incident review: timeline, cause, fixes and what changes so it doesn't happen again.
Phase 4 of 4
For procurement and IT
Request our documents
NDA, data processing agreement, security overview, or your own questionnaire answered. We don’t claim certifications we haven’t been audited for.
Prefer email? hello@cartsmiths.dev
Book an architecture review
A 60-minute session with a senior architect. We review your current platform, integrations and growth plans, then send a written summary of risks and options.
- For companies with a real platform decision coming up
- NDA signed before we talk details
- The written summary is yours to keep