How we work
How we work together
We see your code and how your data is structured. We never see your users' data.
Principles
- You own everything. Your code, database, hosting and payment accounts stay yours. You invite us — we never create accounts for your app in our name.
- Only the access we need. Each service needs a different level of access. The table below shows exactly which.
- No real user data. To test your app, we copy the structure of your database and fill it with generated data.
- Temporary access. You give access for a task and remove it when the task is done.
- Everything on record. Who got which access, when, and when it was removed — logged in a shared document you can always check.
Access by service
Service: Free review
- Code
- Read only
- Database
- Structure only
- Hosting, payments and keys
- None
Service: Access & data test
- Code
- Read only
- Database
- Structure only
- Hosting, payments and keys
- None
Service: Deep audit
- Code
- Read only
- Database
- Structure only
- Hosting, payments and keys
- List of settings, without secret values
Service: Emergency fix
- Code
- Changes via review*
- Database
- Structure; an anonymized example if needed
- Hosting, payments and keys
- Error logs without personal data
Service: "Ready to grow" sprint, Feature sprint, Speed & load, Investor ready
- Code
- Changes via review*
- Database
- Separate test database
- Hosting, payments and keys
- Test keys only (e.g. Stripe test mode)
Service: Migration
- Code
- Changes via review*
- Database
- Temporary access during the move, with your written consent
- Hosting, payments and keys
- Temporary access, removed right after
Service: Basic care, Monthly support, Dev on demand
- Code
- Changes via review*
- Database
- Separate test database
- Hosting, payments and keys
- Monitoring alerts without personal data
Service: Coaching
- Code
- Your screen, on a call
- Database
- None
- Hosting, payments and keys
- None
*Changes via review: we propose every change as a pull request — a change that you or automatic checks approve before it goes live.
Step by step
Before we start
We sign a non-disclosure agreement (NDA). For clients in the EU, also a data processing agreement (DPA). You get this page as a reference, so you know in advance what we'll ask for and when. We use AI coding tools only with settings that don't allow your code to be used for training. Don't want AI tools on your code? We work without them.
Your code
For reviews and audits, you add us to your repository (where your code is stored) with read-only access. For paid work, we get write access, but your main branch (the main version of your code) stays protected: changes go in only through pull requests that you or automatic checks approve. Building in Lovable? Lovable writes your changes straight to the main branch, so we set the protection up to keep that sync working, while our own changes still go through pull requests. Your app lives in Lovable, Bolt or Replit without a repository? You connect your project to GitHub (a service for storing code) or send us a code export.
Your database
You export only its structure: tables, links between them and access rules. No rows, no user data. We give you a ready command or do it together on a call. We build a copy from this structure and fill it with generated users, orders and payments. All tests run on this copy — including the access & data test, where we try to open one test user's data as another user, get paid features without paying or act as an admin. If a bug only shows up on real data, we ask for a specific anonymized example, or you show it to us on screen during a call.
Test environment
For sprints and monthly plans, we set up a separate test copy of your app (staging) in your accounts: its own database with generated data and its own address. We use test keys only: Stripe in test mode and separate AI service keys with spending limits. Every change is checked there first, then goes live.
Secrets and your live app
Your live keys stay in your hosting settings. We don't see them and don't ask for them. Need a new key? You add it yourself, following our instructions. Changes go live automatically after approval, with no manual access to your servers. Secrets never go through chat or email. If there's no other way, we use a one-time link from a password manager that expires after opening.
Migration: the only exception
Moving real data without access to it is impossible. So access is given with your written consent for a set time window. Data goes directly from your old account to your new one, with no copies on our computers. Right after the move, access is removed and you change all keys. Prefer to keep control? You run the move yourself, following our instructions, on a shared call.
Emergencies
If your live app is down and we can't find the cause without more access, we ask for temporary access and wait for your explicit approval. We log what we did and when. Once it's fixed, access is removed. This only applies when we need more access than usual. Work on the fix itself starts on time.
Monitoring
We connect error tracking that automatically hides personal data: emails, names and access keys. You don't have to keep an eye on the app yourself: alerts go to both you and us.
When we finish
You remove us from all services using a checklist we give you. We delete local copies of your code and test database and confirm it in writing. If we saw any key during the work, you change it.
Our own security
- Separate work accounts for every service, two-factor login everywhere.
- A password manager and an encrypted disk.
- We keep client code only while the work lasts.