DatabyPassion publishes the controls that already operate, the choices agreed when an engagement starts, and the facts we will not overstate. Use this page in a procurement or security review. Contract terms and client policy still govern the work.
Confidentiality, roles and the support needed for a specific engagement are made explicit during scoping.
Client information is used only for the agreed engagement and handled under the confidentiality terms that apply to that work.
Contract, privacy and AI-governance questions are handled with an independent practising counsel — not an employee and not a permanent bench member. The partner is brought in when the engagement needs that depth. Scope, confidentiality and access are agreed before any client context is shared.
Studio-controlled environments are the working default. Client-controlled environments are available when policy or architecture requires them.
Work begins in named DatabyPassion-controlled environments. Access is limited to the delivery team for that engagement.
Delivery moves into client-controlled repositories, clouds and toolchains when architecture or policy requires it. That choice is named in the engagement terms.
Access, retention, model use and human review are scoped around the workflow rather than assumed from a generic policy.
Access is limited to the systems, information and people needed for the agreed work.
What is retained, where it lives and when access or copies are removed is written into the engagement terms.
Client data is not used to train DatabyPassion models or public models for unrelated purposes.
Approved providers, grounding, evaluation, human review and fallback rules are defined around the use case before the work starts.
Source, secrets, specialist access, key decisions and handover artefacts stay in the operating record.
Repositories, secrets and access paths are documented for the work. They are not shared through public code or informal hand-offs.
Specialists join an engagement under confidentiality and intellectual-property obligations appropriate to their role.
Key decisions, code, designs and runbooks stay in the engagement record so ownership can transfer cleanly.
Website hosts are not project subprocessors. Cloud and model providers for the work are named in the engagement.
The public website is hosted by Vercel. Source collaboration uses GitHub. Project cloud and model providers are named during scoping; they are not implied by this website.
DatabyPassion does not hold SOC 2 certification. Required controls and evidence are discussed before an engagement starts.
The statement of work names the systems, people, providers, permitted data, retention and deletion, incident contacts and handover required for the engagement.