Trust

Everything we hold,
and everything we do not.

Most vendors put a row of certification logos on this page and hope nobody checks the scope on them. We would rather publish the whole list, including the four lines where the honest answer today is no. If any of those four is a blocker for you, it is better that you find out here than in month two.

Read the status list Where our data would sit Last reviewed 4 August 2026
Status

The list, with nothing taken out of it.

Four states, and they mean what they say. By design is a property of how we build, not a policy we wrote down. Scheduled carries a date. Not held means not held, with no adjective in front of it.

Data residency
By design
European Union throughout. During the build on our infrastructure in Germany, after handover on yours, wherever you choose to put it.
Per person access
By design
No shared logins and no shared password. Six roles, enforced in the database rather than only in the interface, so a direct query obeys them too.
Audit trail
By design
Accounting entries are hash chained. An altered figure is detectable rather than arguable, and lock dates stop a closed period being rewritten.
Change control
By design
Nothing reaches production except through a reviewed change with 2,378 automated checks green. Every deploy records the commit it published, and rolling back is that commit redeployed by the same script.
Encryption in transit
In transit only
TLS 1.3 everywhere, and secrets in environment files readable only by root, never in the repository. Full-disk encryption on the hosts is not in place: our provider does not offer it on these machines and we have not built it ourselves, so we say so here rather than let the row imply it.
Backups, verified daily
Partly
Daily, offsite, thirty day retention, and every dump is read back by the tool that would restore it before the run counts as done. A scheduled full restore rehearsal is not yet in place, and until it is, this row says so: a backup nobody has restored is a rumour, and we would rather name ours than round it up.
GDPR data processing agreement
Held
Signed before the first probe of your systems, together with a mutual NDA. Standard contractual clauses where a subprocessor needs them.
Incident response procedure
Held
Named on call person, notification to you inside 24 hours of confirmation, a written post mortem inside five working days.
Third party penetration test
Scheduled
Booked for Q4 2026 against the reference build. Not done yet. The summary will be published on this page with its date, whatever it says.
ISO 27001
Not held
We are a small engineering company and we have not certified. We will start the process when a client contract requires it, and this line will say so until we have the certificate in hand.
SOC 2 Type II
Not held
Not held and not planned. It is a North American procurement instrument and none of our clients have asked for it. If yours does, tell us early, because it is a year of work.
24/7 monitored SOC
Not held
We run health checks and alerting, not a staffed security operations centre. After handover this is your responsibility on your infrastructure, and we say so in the runbook.
Cyber liability insurance
Scheduled
Being placed for the 2026 to 2027 year. Certificate available to clients once bound.
Your data

Three phases, and in the third one we are gone.

Every hosted vendor's security page is an argument about how well they guard your data forever. Ours only has to hold for a few months, because after that it is not ours to guard.

Phase 1 · weeks 1 to 3

While we build

We read your live systems to write the spec, and we run a build environment on our infrastructure.

Where
Hetzner, Germany
What
Structure and volumes, plus a working copy of your data
Who
Named engineers only, listed in the DPA
Phase 2 · months 1 to 6

While we run it with you

The system is already on your server. We hold time boxed access to keep building and to teach your person.

Where
Your infrastructure
What
Nothing of yours on ours, except logs you can see
Who
Named accounts, revocable by you at any moment
Phase 3 · after handover

After we leave

Access is removed on the date in the contract. Certification is signed by both sides and lists every account closed.

Where
Yours alone
What
Nothing
Who
Nobody at a-systems

After handover your data is not on our infrastructure at all. No vendor with a subscription business can write that sentence.

Controls

What actually prevents the incident.

Policies do not stop breaches, mechanisms do. These are the ones that sit in the code and in the pipeline, where they cannot be forgotten under a deadline.

The merge gate

Nobody can push straight to the main branch, including us. A change enters through review with lint, types, schema, the full suite and the build all green, or it does not enter.

2,378 checks · enforced by the platform, not by discipline

Tests that can actually fail

Money, tax and stock logic is written test first. We also check the suite can go red: a green build that is structurally incapable of failing is worse than no build, because it is trusted.

Domain invariants covered, not endpoints

Every deploy records what it shipped

The deploy script writes the exact commit it published and reads it back on the next run, so what is running is answerable without opening a shell. Rolling back is that commit redeployed by the same script. A release that the project's own roadmap does not call shipped stops the deploy until somebody names it.

One script, never a hand-typed command on the server

Roles in the database

Row level security means a role restriction holds even for a direct query, not only for a screen. A read only user is read only to Postgres itself.

6 roles · every write attributable to a name

Integrations run in sandbox by default

Every external system has a real mode and a mock mode, and a new environment starts in mock. Loading your real customer addresses cannot accidentally email or ship to them.

Channels default to off until you open them

Secrets never enter the repository

Credentials live in environment configuration on the host with restricted permissions. The repository records where a secret lives, never what it is.

Scanned on every change
Subprocessors

Everyone who could touch it.

The list applies to the build phase. After handover you choose your own, and this table stops being about you.

ProviderPurposeRegionHolds your business data
Hetzner OnlineCompute and storage for the build environmentGermanyYes
SupabaseManaged Postgres and authenticationEU regionYes
ResendTransactional email from the systemEU routingAddresses only
GitHubSource control and the merge gateEU / USNo, code only
AnthropicThe AI engineering that builds the systemUSNo, structure and code only

On the last row, plainly: we do not send your business records to a model. What goes out is schema, code and the shape of a problem. If your policy forbids even that, say so at the first call and we will scope the build differently.

Shared responsibility

What we sign, and what we need from you.

Handing you the keys means some of this genuinely becomes yours. Better to name which parts now than to discover it during an incident.

Ours

  • Mutual NDA and a GDPR processing agreement, signed before we look at anything
  • The build environment, its patching and its access list
  • The controls above, delivered inside the system rather than promised around it
  • A runbook written for someone who has never met us
  • Notification inside 24 hours and a written post mortem inside five days
  • Every account we hold, listed by name, closed on the certification date

Yours, from handover

  • Server patching and operating system updates
  • Who has an account, and removing people when they leave
  • Watching the health alert, which we point at your address before we go
  • Restoring from backup if it comes to that, which you will have rehearsed with us
  • Reviewing what your own AI agent proposes before it merges
  • Deciding whether to keep us on for any of the above

Send this page
to your worst sceptic.

Preferably the person who has been burned by a vendor before. If they come back with a question this page does not answer, that question belongs on it, and we will add it.

Request the DPA and NDA Book a technical review security@a-systems.pro