Security & trust
What your procurementteam will ask us.
Legal and security teams usually ask the same questions before they sign with a small vendor. Here are our answers. If yours is not covered, ask and we will put it in writing.
Confidentiality and NDAs
Anything you share with us is confidential: your code, your data, your plans, and the fact that we are working together, unless you say otherwise.
If you need an NDA before we talk details, we will sign a mutual one. Your template is fine.
Who owns what
You own what we build for you. Code, designs, and documentation transfer to you when the invoice is paid, and the source sits in a repository you control from the start.
We keep our own tools and general know-how. We do not reuse your code or your data on another project.
Where your data lives
Where we can, we work inside your systems: your repositories, your cloud accounts, your logins. Access is set up for the project and removed when it ends.
If we host for you, you pick the region. Canadian clients can keep data in Canada. US clients can keep it in the US. Nothing goes onto personal devices or consumer tools.
How we secure our own work
The people who run our penetration tests also review what we ship. In practice that means:
- Multi-factor authentication on every account, with hardware keys where the service supports them
- Access limited to what the project needs, and removed when it ends
- Secrets kept in a vault, not in code, chat, or email
- Every change reviewed by a second engineer, with dependency and secret scanning in the pipeline
- A security review before anything goes to production
Compliance
Our security lead holds GIAC GCIP (NERC CIP), OffSec OSCP and OSWE, and Zero-Point Security CRTO. We have worked inside SOC 2, PCI DSS, HIPAA, and NERC CIP programs and can document the controls your auditors ask about.
Insurance
We carry commercial general liability and professional (errors and omissions) insurance. Ask and we will send the certificate.
Procurement paperwork
Security questionnaires, supplier onboarding forms, W-8BEN-E for US clients: send them over. We return them within five business days, usually sooner.
If something goes wrong
If we find a security incident that affects your systems or data, you hear it from us within 24 hours: what happened, what it touches, and what we are doing about it.
When a project ends, we hand back credentials, rotate anything we had access to, and confirm in writing that our access is gone.
Need a specific document, like an NDA, certificate of insurance, or a completed security questionnaire? Email hello@workbence.agency.