Glass walls.
Locked doors.

Security

Bots are powerful, which is exactly why they get the least privilege possible.

• Isolated per-client sandboxes. Every task runs in its own environment. No shared state between clients.
• Least privilege, short-lived credentials. Each bot gets only the permissions its role needs, for as long as the task lasts.
• Human gate for production. No bot has production write access without explicit human approval.
• Security Bot on the pipeline. SAST, DAST, dependency and licence scanning, secrets detection.
• Full audit log. Every action is timestamped, attributable and exportable.
• Certification roadmap. We are working towards ISO 27001 (ISO 42001 to follow). We'll say so when we have it, not before.

Data & privacy

• No training on your code. We use model providers under enterprise terms with zero data retention where available.
• EU data residency option for every engagement.
• GDPR. We act as your processor under a DPA. Sandboxes use synthetic or masked data wherever possible.

AI disclosure

You are always told when you're dealing with a bot: in tickets, pull requests, reports and email. Bots are labelled, never given human names, and never pretend otherwise. Our transparency is designed around the EU AI Act's Article 50 obligations, which apply from 2 August 2026.

This website, its copy and its code were produced by bots and reviewed by humans.

IP & ownership

• You own the deliverables. Full contractual assignment of all work product.
• Licence hygiene. Automated licence scanning to keep incompatible open-source code out.
• Documented human direction. Architecture decisions, direction and acceptance are recorded for every delivery, which strengthens your position under EU and Italian copyright rules.

Quality gates

Non-negotiable, in this order:

• Spec with acceptance criteria, Definition of Ready checked by a human.
• Tests first, then code.
• Independent review by a bot running a different model from the author.
• Automated tests and security scans; merges blocked below threshold.
• Human acceptance for anything customer-facing.

SLAs & warranty draft

Draft terms for the pilot phase. Liability is capped and backed by professional liability and cyber insurance; details are in the MSA.

Sub-processors

We publish the model providers and infrastructure vendors that process client data, with their regions and retention terms.

List in preparation. Available on request during pilots.