Security and ownership
Built for security and control
Security starts with the workflow and data, not a generic checklist added before launch.
Ownership model
Clear data ownership. A path to independent use.
Your business data remains yours. The date we hand over the application source code for independent use depends on your subscription plan. The exact date and handover terms are recorded in your agreement.
On the handover date defined by your subscription plan, you receive source code with non-exclusive rights to run and maintain your version independently, yourself or with another provider.
Architecture, review, tests, release and documentation.
Your organisation decides what the product should do.
Monitoring, support and maintenance within the chosen plan.
Use an AlmOps-managed environment, or client-owned infrastructure with managed support where your plan includes it.
Keep dependencies, procedures and known risks documented.
Typical technical baseline
Controls matched to the workflow's risk.
The final architecture and control set are scoped during discovery. Certifications are never implied unless explicitly evidenced.
Identity and access
Role-based permissions, least privilege, strong authentication and access review.
Data protection
Encryption in transit and at rest, backups, retention and environment separation.
Auditability
Relevant user actions, privileged access, releases and system events for review.
Secure delivery
Peer review, automated checks, secrets management and controlled deployment.
Operational response
Monitoring, severity definitions, incident communication and recovery procedures.
Vendor boundaries
Documented infrastructure, subprocessors, integrations and responsibility split.
AI-assisted development
Faster production. Human accountability.
AI can help structure requirements, draft implementation and extend test coverage. It does not approve architecture, access production independently or own a release decision.
Approved tools and boundaries
Client information follows agreed confidentiality, retention and tool-use rules.
Review material changes
Engineers verify behaviour, security implications and maintainability before release.
Test the output
Automated and human validation assess the actual software and workflow outcome, not the quality of a prompt.
Due diligence
A practical evidence pack for the product.
The level of detail grows with the system's sensitivity and the client's procurement process.
System map
Components, environments, trust boundaries and integrations.
Data flow
Classes, locations, retention, backups and export.
Runbook
Monitoring, access, incidents, recovery and support contacts.
Change record
Repositories, review, tests, releases and dependencies.
Bring security into discovery
Tell us what the workflow handles and what failure would mean.
We reflect those constraints in architecture, hosting, commercial scope and the operating plan.