Security
Security and data handling
We build systems that hold operational data, so this page states our working practices plainly. We do not hold formal certifications yet and will not imply otherwise; what follows is what we actually do, and you are welcome to audit it in an engagement.
Access and credentials
- Least-privilege access by default: we request the narrowest scopes that let us do the work, and access is removed when an engagement ends.
- Secrets live in secret managers or environment configuration, never in code or version control. API keys stay server-side behind proxies we control.
- Client systems are accessed through accounts you issue and can revoke, not shared logins.
Environments and change
- Development, staging, and production are separated, with production changes flowing through review.
- Every system ships with an audit trail for the operations that matter: who changed what, and when.
- Infrastructure and deployment are documented in runbooks that your team can execute without us.
Data handling
- Your operational data stays in your accounts and your region wherever the platform allows it. We do not copy client data into our own systems beyond what an engagement requires.
- AI features are architected so models receive the minimum context needed, with provenance recorded for AI-derived fields. Client data is never used to train models.
- Backups and recovery paths are designed per system and stated in the architecture documents, not assumed.
Confidentiality and terms
- NDA-by-default: we are glad to sign yours before the first substantive conversation.
- Data processing agreements are available where regulation requires them.
- Case studies name a client only with written permission; otherwise the work is anonymized, as it is on this site.
This website
The site itself follows the same rules. It ships as prerendered static pages with no tracking cookies. Form submissions go to our private workspace; the chat assistant is served through our own server-side proxy so no model API key ever reaches your browser. Details are in the privacy policy. If you find a security issue anywhere in our surface, write to hello@appropriatetechsolutions.com and it will be read by an engineer the same day.