Security & IP

Your code, your IP, your repository.

This is the page for procurement, security, and legal, and it’s short on purpose.

Request documents Jump to AI in delivery

Seven things hold on every engagement.

  • 01

    SOC 2 Type II

    We are SOC 2 Type II compliant. The report is available under NDA.

  • 02

    You own the IP

    Everything we build for you is yours, including code, designs, and documentation, from the first commit.

  • 03

    Your repository, your access controls

    The work lives in your GitHub or your source control, not ours.

  • 04

    You can see every decision

    You get the project tracker, repo access, and a written record of every architecture decision. Nothing about the work lives only in our heads.

  • 05

    A named senior owner

    Every engagement has a named senior owner, and you’ll always know who to call.

  • 06

    Licenses checked before they ship

    Every dependency’s license is checked in CI with Very Good CLI’s license checker, so nothing ships with a license your legal team hasn’t seen.

  • 07

    Where the team is

    Our team works across the US, Latin America, and Europe, in hours that overlap with yours.

  1. How to de-risk hiring an app development agency
  2. Very Good CLI license checker

Security is part of the standard, not a phase at the end.

  1. Every project starts from Very Good CLI with 100% test coverage on the starter code, and new code keeps it there.
  2. Our engineering handbook includes a mobile security guide built on the OWASP Mobile Application Security checklist.
  3. Code review happens on every pull request, and the architecture keeps each layer’s access to data explicit.
  1. Very Good Engineering, including “Security in mobile apps”
  2. Securing a Flutter web app with Firebase App Check

AI on your code follows your rules.

We use AI across our delivery. These are the rules it works under.

  • An agent works with the access of the person it’s working for, and no more.

  • How much an agent can do depends on the project’s scope, objectives, and rules.

  • We’ll adapt our usage to fit your policies and comfort with AI tooling.

  1. What changes about code review when AI writes your code
  2. Claude Code dynamic workflows at scale
  3. The Very Good CLI MCP server

Your team approves what GenUI builds with.

  1. The model can only compose from a catalog your review board approves once, built from your design system.
  2. Every request clears five checks: authenticate, screen the request, validate structure, validate content, and enforce intent.
  3. The screening layer is built on Google Cloud’s enterprise model safety service.
  4. Checkout and payment, legal wording, and core navigation are never generated.
  5. The first GenUI zone can run in a sandbox on synthetic data, so it clears review without touching personal data.
  1. The GenUI approval checklist
  2. Hallucinations in generative UI: a four-layer defense
  3. GenUI

Here’s what we can send your team.

  1. SOC 2 Type II report, under NDA
  2. Our standard terms
  3. Our mutual NDA
  4. Insurance certificates
  5. A completed security questionnaire
Request documents

We route every request to the person who can answer it, usually the same day.

The questions your security team will ask first.

01 Who owns the code and IP?

You do, from the first commit. That includes code, designs, and documentation.

02 Where does the code live?

In your repository, under your access controls. We work in your source control, not a copy of it.

03 Are you SOC 2 compliant?

Yes, SOC 2 Type II. The report is available under NDA.

04 Do you use AI on our code?

Yes. An agent works with the access of the person it’s working for, and we’ll adapt our usage to fit your policies and comfort with AI tooling.

Laura Hughes Lekhi Director of Business Development
Greg Laird Senior Business Development Executive
Jorge Coca VP of Engineering

Send this page to whoever needs to approve it. That’s what it’s for.

Anything it doesn’t answer, we’ll get to the right person.

Request documents Start the conversation