Everything procurement will ask, answered before you ask it.

Client data stays in your infrastructure wherever technically possible. Where it must transit our systems, it is encrypted at rest and in flight, access is role-scoped and logged, and the access list is reviewable by you at any time.

We work under your DPA or ours, whichever you prefer.

No. It is a contract term, not a policy.

We use model endpoints with training disabled and zero-retention terms, and we will show you the specific clause from each vendor agreement.

You do. All of it — code, designs, documentation, prompts, eval sets and model artifacts — assigned on final payment.

We retain no licence except the right to describe the work in general terms, and only with your written approval of the text.

A published list with each subprocessor's function, location and the data category it touches.

Thirty days' notice before any addition, with a right to object.

Acknowledgement within one hour for a P1, a named incident commander, hourly updates, and a written blameless post-mortem within five business days.

Notification timelines for personal-data breaches follow the stricter of GDPR or your contract.

[Stated plainly — countries, not regions. This bracket must be filled with the actual list before the page is published.]

Data residency is configurable per engagement; we will confirm the region in the SOW before work begins.

[Current status, stated precisely — including anything in progress, with the expected date.]

We will never imply a certification we do not hold. If a control you need is not yet certified, we will tell you which compensating controls are in place and let you decide whether that is sufficient.

Every system is classified against the EU AI Act risk tiers at design time, and the classification is recorded in the architecture document.

Controls are mapped to NIST AI RMF functions, and the mapping ships as a deliverable rather than living in a slide.

Yes. Turnaround is typically two business days.

Our standard versions are in the Procurement Pack if you would rather start from ours.

[Types and limits, stated. Certificates are in the pack.]

If your contract requires a specific limit or an additional-insured endorsement, tell us during diligence rather than at signature — it is routine, but it takes a few days.

Four to six weeks, fixed scope, fixed price.

Exact figures are published on the Discovery page — we do not make you ask.

Fixed-price phases wherever scope allows, and time-and-materials only where it genuinely does not.

We will tell you which we think applies and why. No retainer that renews silently.

We build in your cloud accounts, on open or widely-supported tooling, with infrastructure as code and documentation written for someone who has never met us.

The test we hold ourselves to: could a competent team you hire next month take this over without calling us? If not, we have not finished.

Yes, and the discipline is identical — the difference is scope, not standard.

Named senior practitioners, introduced before you sign, present from kickoff to readout.

No SDR, no account manager, no junior taking notes for someone who leaves after week one.

Every engagement has a named second who is genuinely current on the work — not a name on an org chart.

Handover documentation is maintained continuously, not written at the point of departure.

A shared channel with your team, written weekly status, a fortnightly readout, and a decision log you can read at any time.

No status meeting that exists to produce a status meeting.

Yes, and we will tell you exactly where and under what controls.

It is disclosed in the SOW, and any client data touched by our internal tooling is governed by the same terms as everything else.

Both are available and we will recommend one.

Stabilisation support is standard for the first [N] weeks, including on-call alongside your team. After that, either an agreed support arrangement or a clean handover with runbooks, architecture decision records and a working knowledge-transfer plan.

Everything: source, infrastructure code, documentation, runbooks, eval sets, decision records, and credentials transferred to your control.

Nothing stays behind that you would have to ask us for.

Only with written approval of the final text, and never with figures you have not confirmed.

Anonymised is always an option.