Your systems stay yours
The safest place for your data is where it already is. We build inside your accounts, with access you create and can revoke, and we keep no copy of your customer data. This page and the due-diligence pack answer what a vendor questionnaire usually asks.
How every engagement runs
These are not options. They apply every time.
Builds run in your accounts
Code, scheduled jobs and databases run in your cloud account or on your servers. When we hand over, there is nothing of yours left running on ours.
We store no client data
We do not copy your customer, ticket, billing or account records to our systems. Working files needed during a build stay in your environment.
Read-only first
Discovery and audits use read-only access. Write access is requested only for the systems a build changes, and only after you approve the design.
Credentials in your vault
You create the keys, in your own secrets manager, scoped to least privilege. We never ask for passwords by email or form, and keys never go into code.
Dry run and rollback
Every write runs as a dry run first, takes a snapshot of the records it will touch, and ships with a rollback manifest that can undo the run.
AI stays where you say
No client data is sent to a third-party AI service without your written approval. AI review can run entirely on your own hardware.
What we commit to in writing
Included in every proposal.
Incident notice within 72 hours
If we become aware of a security incident affecting your systems or data, we tell you within 72 hours, with what we know and what we are doing.
Access removed at the end
At the end of an engagement you revoke our keys and accounts; we confirm in writing within five business days that we hold no copy of your data and no working credentials.
A full audit log
Every automated action is logged with who, what, when and the before and after values, in your environment.
Least privilege, reviewed
Access is scoped to the objects a build needs. We list every permission in the scope so your team can approve each one.
Services we use
None of them receive data from your systems. They handle our own website and correspondence.
| Service | What for | What it sees |
|---|---|---|
| Cloudflare | Hosts this website, the assessment and booking forms, and routes email to our mailbox. | Form entries and email you send us. No client system data. |
| Google (Gmail) | Our mailbox for correspondence. | Email you send us. No client system data. |
| Our own server | Sends booking confirmations and guide downloads. | Your name and email address. No client system data. |
| Jitsi Meet | Video calls, if you choose to meet over video. | The call itself; nothing is recorded. |
Version 1.0, 28 October 2026. We will update this page before adding any service that would see client data, and tell current clients first.
Questions
Anything else, write to hello@tightlywired.com.
Do you have a SOC 2 report?
Will you fill in our vendor questionnaire?
Who has access to our systems?
What happens to our data at the end?
For finance and regulated firms
Advisers, insurance agencies and accounting firms are asked to oversee their service providers. Because builds run in your environment and we keep no client data, the oversight is short: review the permissions listed in the scope, approve them, and revoke them at the end. How an engagement runs.
Schedule a 30-minute assessment
Bring one process that costs your team hours each week. You will leave with an integration approach and a fixed-price estimate, whether or not we work together.
Schedule an assessment Pick a time now · or write to hello@tightlywired.com