Start hereView all services
AI Discovery WorkshopFind the AI use case worth building first. · 1 day + written plan in 5 daysAI PilotOne use case, working in 4-6 weeks. · 4-6 weeksAI PodA dedicated AI team on your roadmap, monthly. · Monthly, cancel with 30 days' notice
WorkResources
Trust & security

How we handle your data

NDAs, access control, model training rules and the frameworks we build to.

Data handling and NDAs

  • We sign mutual NDAs before any confidential material is shared.
  • Client data is accessed only on systems and accounts you approve.
  • Production data is not copied to personal devices; test data is anonymised where possible.
  • Access is removed at the end of the engagement and confirmed in writing.

Keeping your data out of model training

  • We use AI provider APIs and enterprise settings that do not train on your inputs or outputs.
  • Where required, we deploy open-source models (LLaMA, Ollama) inside your own cloud.
  • Prompts, logs and evaluation data are stored in your accounts, not ours.

Access control and code ownership

  • Least-privilege access with named accounts and no shared logins.
  • Code lives in your Git organisation from the first commit.
  • You own all custom code, prompts and documentation under the contract.
  • Secrets are stored in managed secret stores, never in code.

Compliance frameworks we build to

  • HIPAA: encryption, audit logging, access control and BAA-ready hosting for PHI.
  • GDPR: data minimisation, consent, data-subject requests and EU hosting options.
  • EU ESPR: Digital Product Passport data models and access rules.
  • SOC 2 readiness: we build the controls and evidence your auditor will ask for.

Certifications

  • We do not currently hold ISO 27001 or SOC 2 certification.
  • We are preparing an ISO 27001 / SOC 2 readiness plan and will publish progress here.
  • Client reviews will be published on Clutch.

Incident process

  • Suspected incidents are reported to your named contact within 24 hours.
  • We contain, investigate and share a written incident report with root cause and fixes.
  • For HIPAA work we follow the breach-notification terms in your BAA.

Company registration and contact

  • Legal name: Bit & Bytes LLC
  • Markets served: United States and United Kingdom (remote-first)
  • Sales and general enquiries: hr@bitandbytes.net
  • NDAs available on request before any confidential material is shared
  • Privacy policy: /privacy
Next step

Need our security answers for a questionnaire?

Book a short call with a senior engineer. No pitch deck, just a clear next step.

  • We reply within 1 business day.
  • NDA available on request
  • You own all code from day one

Request our security answers

What do you need? Select one or more

We reply within 1 business day.