What we do with your
data, your systems
and your IP.

Enterprise buyers ask the same questions before an engineer touches a repository: who will see our data, who owns what we build, what happens if someone leaves, and what happens if something goes wrong. This page answers those in advance.

We are a founding-stage firm and we would rather be precise about our current position than imply a maturity we have not reached. Where a control is aspiration rather than practice, it says so.

Intellectual property

You own what we build for you. Every engagement contract assigns all deliverables — source code, models, prompts, evaluation sets, documentation, infrastructure definitions — to the client on creation. We do not retain a licence to reuse client-specific work for another client.

Two clarifications that matter in practice:

• Pre-existing components. Where we bring our own reusable libraries or reference architectures into an engagement, those remain ours and you receive a perpetual, irrevocable licence to use, modify and sublicense them as part of your system. We identify these in writing before they enter the codebase, so there is never a dispute about what is yours.
• Open-source dependencies. We track licences for everything we introduce and will not add a component whose licence conflicts with your commercial model. If you have an approved-licence list, we work to it. If you do not, we default to permissive licences only and flag anything copyleft for your decision.

Confidentiality and personnel

• Mutual NDA before technical discussion. We sign before a readiness audit begins, not after.
• Every engineer is bound individually. Confidentiality obligations sit in each employment contract, not only in the client-facing agreement, and they survive the end of employment.
• We do not subcontract. Everyone on your engagement is a Vantidge.ai employee. This is the single most common failure point in offshore delivery and we removed it structurally rather than managing it.
• Background verification on employment history, education and identity before joining a client engagement. Where a client requires additional checks, we run them at our cost.
• You interview anyone joining your team. No substitution without your approval.

Access to your systems and data

Our default posture is to hold as little of your data as possible.

• Least privilege. Engineers receive the narrowest access that lets them do the work, granted per person and per system, and reviewed when scope changes.
• Your identity provider, not ours. Wherever possible our engineers work inside your tenancy using accounts you issue and can revoke instantly. We prefer this to any arrangement where access depends on us deprovisioning correctly.
• Production data stays in production. We do not copy production datasets to developer machines. Where realistic data is needed for evaluation, we work with masked or synthetic sets generated inside your environment.
• Named access register. You can ask at any time for the list of individuals with access to your systems, and what level. We maintain it as a matter of course.
• Offboarding within one business day of an engineer leaving your engagement or the company, and we notify you rather than waiting to be asked.

Engineering practices

• Version control for everything, including infrastructure definitions and prompts. Nothing reaches an environment without a reviewed commit.
• Peer review required before merge. No direct commits to protected branches.
• Secrets held in a managed secret store, never in source, configuration files or CI variables in plain text. We will flag it if we find your existing setup doing this.
• Dependency and vulnerability scanning in the pipeline, with an agreed severity threshold that blocks a release.
• Staged environments with promotion gates. Canary or shadow deployment for anything that changes model behaviour in production.
• Audit trails on model and prompt changes, so a decision made six months ago can be reconstructed.

Data residency and cross-border transfer

We deliver from India for clients in the US, UK and EU, which makes residency a design question rather than a footnote.

Where your regulatory position requires that data does not leave a jurisdiction, we architect for it: our engineers work through remote access into infrastructure inside your region, with no data at rest on Indian infrastructure. This constrains some tooling choices and we will tell you which ones during the readiness audit rather than discovering it later.

Where transfer is permitted, we document what moves, on what legal basis, and under which contractual safeguards.

Certifications — our actual position

We hold no third-party security certifications today. We are not going to claim otherwise, and you should be sceptical of any firm of our age that does.

Standard	Status
ISO/IEC 27001	Not certified. Controls are being documented against the standard with the intention of pursuing certification. No audit has been scheduled.
SOC 2 Type II	Not certified. Requires an observation window we have not yet completed.
GDPR / UK GDPR	Not a certification. We act as processor under client instruction and will sign a data processing agreement.
India DPDP Act 2023	Compliance obligations acknowledged; practices described on this page are intended to meet them.

If your procurement process requires certification we cannot yet produce, say so early. In some cases a client-run security assessment plus contractual commitments is an acceptable substitute; in others it is not, and it is better for both of us to establish that in week one.

If something goes wrong

• We tell you. Any suspected incident involving your data or systems is reported to your named contact within 24 hours of detection, before we have finished investigating.
• Preservation first. We preserve logs and evidence rather than remediating in a way that destroys the record.
• Written account. You receive a factual timeline, an assessment of what was and was not affected, and the remediation taken.
• Contractual notification periods in your agreement override anything on this page if they are shorter.

Exit and continuity

Structural dependence on a supplier is a risk, and we would rather not be one.

• Knowledge transfer is a scoped deliverable with a date, not a closing gesture. Runbooks, architecture documentation and pairing sessions are in the statement of work.
• All credentials, repositories, registries and infrastructure accounts are yours throughout. There is nothing to hand back because we never held it.
• For build-operate-transfer engagements, the transfer mechanism and trigger conditions are agreed at the start.
• On termination we delete client data from any Vantidge.ai systems within 30 days and confirm in writing.