Your numbers are nobody's business but yours.

Six commitments, every engagement

Where your data actually lives

Mostly where it already lives today: in your own systems. The reporting work runs on accountant-style access to your accounting platform. The AI work runs inside the tools you already use wherever possible, through scoped connections you can see and cut. Deal work runs on documents you choose to send. We do not build a second copy of your business in somebody's warehouse.

Where a platform does hold data in an engagement, it is the boring, heavyweight kind: your accounting system, our payment processor, our scheduling and email providers. Those platforms carry their own independent security attestations, SOC 2 Type II and ISO 27001 among them, and their audit reports are public. We choose them partly for that. Our own practices ride on top and are listed in full in the privacy policy, including the short list of providers we share anything with and why.

The practices behind those commitments

Commitments are easy to write. These are the working habits underneath them, the same ones a security questionnaire asks about, stated plainly rather than as a checklist nobody reads.

• Two-factor authentication is required on every account that touches client work, so that a stolen password on its own opens nothing.
• Credentials belong in a password manager, never in a shared document, a spreadsheet, or an email thread. Where a system supports it, secrets are held by the operating system's own encrypted credential store rather than sitting in a config file.
• Full-disk encryption is required on every machine we work from, so that a lost or stolen laptop is an inconvenience rather than a disclosure.
• Access is granted narrowly and taken back. Read-only wherever the work allows, scoped to the one system that needs it, and dropped when the engagement ends. You can revoke it yourself, any day, without asking us first.
• Access to your systems is a named, revocable grant, never a permanent key. It expires, it is tied to a person rather than to a file, and you can withdraw it yourself in a couple of clicks. The kind of credential that leaks quietly and keeps working forever is not how we connect to you.
• Nothing secret goes in the codebase. No keys, no tokens, no client data in version control, checked rather than assumed.
• A written plan for the bad day. If a device or an account is ever compromised, who gets told and how quickly is decided in advance, not improvised while it is happening.

Contractual, not aspirational

If you handle patient information

Med spas, clinics, and practices covered by HIPAA get a version of this built for them. Nobody can sell you a "HIPAA certificate"; there is no such thing. Compliance is a way of working, and ours is: patient records stay inside your compliant systems, we take the minimum data that does the job, and where your practice is covered by HIPAA we sign a business associate agreement before any file moves. Our med spa reactivation service, for example, runs on a minimal visit export with no names and no clinical notes, and every message to a client goes out under your practice's own authority.

If an engagement would touch protected health information directly, we scope that on the call, in writing, with your compliance obligations stated first. If a piece of work cannot be done inside those lines, we say so and do not do it.

What to keep out of forms and chat

Site forms and the chat widget are for questions, not for confidential material. Keep financial records, account credentials, and anything sensitive out of them. Inside an engagement, documents move through private channels we set up together, and your purchase confirmations name the exact method for anything you buy.