Your code, your data, your accounts.

• The repository, cloud account, model accounts, domains and documentation are created under your organisation at kickoff.
• We work inside them with access you grant and can revoke at any time. There is no handover to negotiate and no lock-in.
• If you stop after the first weekly demo, you keep everything built to that point.

• Your data stays in your cloud account, in the region you choose. EU clients get EU hosting.
• Model accounts are yours, so prompts and outputs run under your own agreements with the provider. Your data is not used for training.
• Where HIPAA applies, the system runs only on cloud and model services covered by a business associate agreement.

• An NDA within 24 hours, if you want one. The first call needs none: we talk about the problem, not your secrets.
• A data processing agreement: we work inside your accounts, so for personal data we are your processor.
• A business associate agreement before any protected health information enters the system.

• The founder reviews every change. AI coding agents write code only inside your repository, under review.
• Every change ships with tests and passes an automated gate before it reaches you.
• AI features get an evaluation set built from your real data, run on every change, and a review queue for cases the model is unsure about.
• Larger builds include roles, an audit log and an external security review; Platform Sprints include a load test and a written security review report you can show auditors.

• We build GDPR-aware and HIPAA-aware systems. Certifying your system, and the legal assessment, stay with you; we say that plainly.

Email support@infinisys.ai with "Security" in the subject. We reply within 1 business day. The same address is in security.txt.