Security and data.

Where your data lives

Systems we build run on platforms in your name: your CRM, your accounting software, your cloud account, your automation workspace. Your data stays in those systems and in the regions you selected for them. We do not move production data into accounts we own.

Builds are developed against sandbox or test accounts with seeded data first, and switched to production only at go-live. Where real records are needed to test, we use the smallest sample that proves the case.

Data residency. If your data must stay in the EU, the UK, India or another region, tell us at the start. We choose platforms and regions that keep it there, and say in the statement of work where each system stores data.

Who can access it

• Roles in your accountsOur engineers work through managed roles or service users that you create and own. You can list, limit and remove them in one click without touching the build.
• Least privilegeEach integration gets its own credential, scoped to the objects and actions it needs. A lead sync cannot read invoices.
• Two-factor on every account we set upRecovery codes are handed to you, not kept by us.
• Named people onlyAccess is limited to the engineers on your engagement. There are no shared or demo logins.
• Removed at the endWhen hypercare or a care plan ends, we hand back admin access and remove ours. You can ask for removal at any time.

Credentials, logs and integrations

• Keys live in a vault, never in codeCredentials are stored in the orchestration platform’s encrypted credential store or your cloud’s secret manager. None are written into workflows, repositories or spreadsheets.
• Rotated on handover and on requestKeys are rotated when the build is handed over, when anyone with access leaves, and whenever you ask.
• Secrets never reach the logsAudit logs redact tokens, card numbers, government IDs and any field you mark as sensitive before a line is written.
• Webhooks verifiedInbound calls are checked against the sending tool’s signature. Unsigned or stale payloads are dropped and counted.

The full engineering standard for integrations is published on our integrations page.

AI models and your data

Where a system uses an AI model, it calls the provider’s business API, normally through an account in your name. Business API terms from the providers we use, such as Anthropic and OpenAI, exclude training on customer data by default. We do not use your data to train or fine-tune models.

We send a model only the fields a task needs, not whole records. Agents act within written permissions: routine actions can run on their own, and anything that moves money, contacts a customer for the first time or deletes data waits for a person to approve it. Every action is logged with who or what approved it.

Handover and the end of an engagement

From day one, admin access, billing, code and documentation sit in accounts in your name, so nothing needs transferring at the end. At handover we rotate the keys we used and hand over a runbook for each system.

When the engagement ends, we remove our access to your systems and delete copies of your data we hold, such as test extracts and working files, unless you ask us in writing to keep them or the law requires us to.

If something goes wrong

If we become aware of a breach affecting your personal data, we tell you without undue delay and in any case within 72 hours, with what we know, what we have done, and what you may need to do. Systems we build have error monitoring with alerts to a named person, and each has a runbook for the first ten minutes.

This website

• Encryption in transitThe site and its form endpoints are served over HTTPS only.
• Form protectionRate limiting, origin checks and a bot trap on every form endpoint.
• Analytics only with consentGoogle Analytics loads only after you accept cookies. Rejecting them never blocks any page.
• RetentionEnquiries that do not become engagements are deleted 12 months after the last message. The full schedule is in the privacy notice.

Questions and reviews

Send security questionnaires, vendor assessment forms or questions to hello@smallbaydigital.com. We return completed questionnaires within five working days.