What we can tell you before you ask
Security posture, data handling, commercial terms and working hours. Including the parts that aren't true yet — because a certification we don't hold is worth less than an honest roadmap.
01
Security posture
What this site does today, and where to check it: every form field is validated in the browser and again on the server with the same schema; automated submissions are filtered by a honeypot, a two-second time trap and per-IP rate limiting; contact messages are built to land in a single table with row-level security enabled and no anonymous access, writable only through a server-held key — and until that database is provisioned, the form refuses to accept a message rather than store it anywhere else; provider secrets live in environment variables, never in the codebase; no analytics or tracking scripts run, no cookies are set — the only browser storage written is your theme preference; and anything not yet real — a profile URL, a partner tier, a study number — is guarded so it cannot render as if it were. Dependency scanning, backups and a formal incident process are not in place on this stack yet.
| Item | Status | Target |
|---|---|---|
| SOC 2 Type II | Not started | When an engagement funds the audit — no date claimed |
| ISO 27001 | Not started | When an engagement funds the audit — no date claimed |
| ISO 42001 (AI management) | Not started | When an engagement funds the audit — no date claimed |
| Cyber insurance | Not started | When an engagement funds the policy — no date claimed |
We build to SOC 2 controls. We don't hold the certification yet, and we'll pursue the audit when an engagement funds it. If you need a certified vendor today, we're not it — and we'd rather tell you now than at week six of procurement. This page is our AI vendor security posture — the true parts and the not-yet-true parts, marked which is which.
02
Where your data lives
Data handling — full statement in drafting. Hosting regions, data residency options, retention periods, deletion process.
Self-hosted and region-locked deployments are normal for us. If your data can't leave the UK or the EU, say so on the first call and we'll architect for it.
Sub-processors
None in production today — no vendor stores this site's visitor data yet. The first provisioned vendor (the form's database, once it exists) is added here with its purpose and region; an out-of-date list is worse than none, so this one starts empty on purpose.
Data processing agreement
Our standard DPA is being drafted with counsel and will be published here when it is final — we don't claim a document exists before it does. If procurement needs one sooner, send us yours and we'll work from your paper.
03
Commercial terms
- Legal entity
- Ahsan Saleem, a sole proprietorship registered in Pakistan
- Registered in
- Lahore, Pakistan
- Governing law
- Pakistan — we’ll contract under yours where the engagement warrants it
- Invoicing
- USD, GBP or EUR — payment rail confirmed before the first invoice
- Payment terms
- Deposit plus milestones on builds; monthly in advance on retainers
- IP
- All work product assigns to you on final payment. It’s in the MSA, not a conversation
- Confidentiality
- Mutual NDA available before the first call if you want one
04
When we’re available
- 09:00–17:00 London time (UK)
- 09:00–17:00 Sydney time (Australia)
Monday to Friday. We don't claim 24/7 — a team our size can't honestly offer it, and you'd find out the first time you needed it. Published response commitments are in each care plan tier.
05
Partner tiers
Nothing granted yet. The programmes this firm works toward are the vendor partner tiers for Make, n8n, HubSpot and Shopify — the stack we already build on. A self-declared tier is not a tier.
06
Accessibility
This site is built to WCAG 2.2 Level AA. If you find something that isn't, tell us and we'll fix it.
Book a build review
Bring your security questions to the first call. We'll answer them plainly.
Book a build review