Transmission
How we handle your code, your data and your accounts.
Everything below is our standard practice on every engagement. If your security team needs it in their own format, download the one-pager or send us the questionnaire.
Our standard practices
Your code stays yours
- All work happens in repositories you own, under accounts you control and can revoke in one click.
- We never fork, mirror or keep copies of client code after an engagement ends.
- IP in everything we write assigns to you on payment, in the contract.
Access
- Least privilege by default: engineers get the repos and environments they need for their tickets and nothing else.
- Single sign-on and multi-factor authentication on every tool we use.
- Access is reviewed monthly and removed the day an engineer rolls off.
Devices and data
- Full-disk encryption, automatic updates and screen lock on every machine.
- No production data on engineer machines. We work with synthetic or sampled data unless you provide a controlled environment.
- We do not currently sign Business Associate Agreements, so we don't take work that involves protected health information.
AI agent policy
- We use AI coding agents on every engagement. Before kickoff we tell you which tools and models, and under which terms (API tiers with no training on your data, enterprise agreements where available).
- You can restrict or exclude AI tooling for specific repositories or data classes, in writing, at any time.
- AI output never merges unreviewed. A senior engineer reads, runs and approves every pull request.
Incident response
- Any suspected security incident involving your systems is reported to your named contact within 24 hours of discovery, with what we know and what we are doing.
- A written post-incident summary follows within five business days.
Company and contracts
- Contracting entity: NorthPulse, Nevada, USA. W-9 and certificate of good standing available on request.
- Insurance: professional (technology E&O) and cyber liability, certificates naming your company on request.
- Mutual NDA available before any access is granted.
What we don't have yet
A SOC 2 report. We follow the controls above and will pursue SOC 2 Type I when client requirements call for it. If you need a report today, we're not the right vendor yet.
Transmission · next step
Send us your security questionnaire.
We answer within three business days, in your format.