Trust and security

IP and ownership

Your accounts, your repositories, assignment in the contract. Repositories for client work are created in your organisation from day one. Cloud, store and analytics accounts stay in your name. Work product is assigned to you in the engagement contract: the product is yours, completely, whether or not we stay on after launch.

NDA

Signed before scoping on request. If you need a mutual NDA before you share a brief, decks or credentials, say so when you book a call or email: we sign before the working session, not after.

Data handling

Where data lives, regional endpoints and retention depend on the systems in your stack and what the engagement needs. Client product data stays in your accounts. Website leads and booking records live in our CRM under the terms on /privacy. We do not keep production secrets or customer PII in shared scratch spaces after handover. Exact retention for marketing leads is listed in the privacy policy (counsel-reviewed before launch).

Access control

Named access only: people on the engagement, not a rotating bench. Access is requested for a reason, logged, and revoked at handover or when someone leaves the work. We do not share credentials in chat; secrets sit in your vault or environment configuration.

Security practices in delivery

Delivery includes CI scanning for dependencies, regular dependency updates, and secrets kept out of the repository. Crash reporting and monitoring are part of the launch checklist where the product needs them. We do not claim certifications we have not earned; ask for the current control list for your questionnaire and we will answer with what we actually run.

AI usage policy

Engineers and designers may use AI coding and writing tools to accelerate drafts, tests and documentation. Client source, credentials, production data and anything under NDA are not pasted into consumer AI tools. Architecture and release decisions stay with named seniors. If an engagement needs a model provider API, it runs in your accounts with your keys - not ours: unless the written scope says otherwise.

Subprocessors

Tools that process website lead or booking data, or that host this site. Counsel confirms the live list before launch; names and regions will match the DPAs in force.

• Hosting provider for algoace.comServes the marketing site. Region: Configured per deployment.
• CRM (inbound webhook)Stores leads and bookings from the website. Region: As named in the live CRM DPA.
• CalendlyScoping-call scheduling after contact details. Region: United States / EU options per their terms.
• Transactional email (Resend or equivalent)Confirmation and reply email. Region: As named in the live provider DPA.
• Analytics and ads tags (via GTM)Measurement under consent where required. Region: Vendor-dependent; see /cookies.

Contact for security questions

Security questionnaires, pentest coordination and incident reports: info@algoace.com. Use the subject line "Security". Replies within one hour in business hours, twelve outside.