Trust centre
The answers your procurement team is about to ask for.
Every enterprise engagement begins with a security questionnaire. We publish our answers to the questions that come up every time, and where the honest answer depends on your contract or your compliance framework, we say so rather than guess.
1 week
Red-team week
Before handover, an engineer who did not build the system spends a week trying to break it.
0%
Outsourced
Everyone who touches your systems is on our own team. No subcontractors.
Day 1
Repository access
You see the code as it is written, not a summary of it.
24/7
Support coverage
From the engineers who built the system, not a support tier that has never seen it.
The questionnaire
Twelve questions we get every time, answered once.
Where is our data processed?
In the region you specify, on infrastructure you can name in the contract. We do not move client data between regions for operational convenience.
Who on your side can access it?
Only engineers assigned to your engagement, through named accounts with multi-factor authentication. Access is granted for the engagement and revoked at handover, and the grant and revocation are both logged.
Do you use client data to train models?
No. Never, on any engagement, under any arrangement. Where a model is involved, the boundary is agreed in writing before work starts.
What are your subprocessors?
A short list, disclosed in full before contract, with the function each performs. We tell you before it changes rather than after.
How do you handle secrets?
In a managed secret store, never in the repository, never in a ticket, never in a message. Rotation is automated and credentials issued to us are scoped to the minimum required.
What is your vulnerability process?
Threat modelling at design, dependency and secret scanning on every push, and a red-team week before handover. Critical findings are fixed first, and anything we cannot fix is reported to you with the mitigation in place and the reason.
Do you carry insurance?
Tell us what cover your procurement process requires and we will confirm in writing what we hold, with certificates.
What happens if you have a breach?
You are told promptly once it is confirmed, on the timescale written into your contract, with what we know, what we do not yet know, and what we are doing. We do not wait for a complete picture before telling you.
Can we audit you?
Yes. Client security reviews are part of enterprise engagements and we will complete your questionnaire, take the call and host the review.
What about the engineering floor in Pakistan?
Same controls, same named accounts, same logging. Location does not change the access model, and we will say plainly which team members are where.
Do you subcontract?
No. Every line of code is written by our own team. There is no contractor bench and no undisclosed third party writing your code.
What happens to our data when we leave?
Deleted on a schedule agreed in the contract, with written confirmation. Backups age out on their documented cycle and we tell you what that cycle is.
AI data policy
The part most vendors are vague about.
What we commit to
- Client code and data are never used to train any model, ours or a vendor’s.
- Model providers are named in the contract, with their data retention terms attached.
- Where you require it, we work with zero-retention endpoints and say so in writing.
- Anything a model contributed to is reviewed and approved by a named engineer before it merges.
What you decide
- Whether AI-assisted delivery is used on your engagement at all. If you say no, the price changes accordingly.
- Which classes of data may leave your environment, if any.
- Which providers are acceptable to you, including the option of a self-hosted model.
- Whether generated contributions must be labelled in the codebase for your own audit.
Report a vulnerability
If you have found something in our systems or in software we built, tell us. Acknowledged within one business day, and we will not threaten you for it.
hello@brilliantsystems.io
Next step
Send us your security questionnaire.
A senior engineer reads every enquiry and replies within one business day. If your procurement team has a questionnaire, send it with your brief and we will answer it properly rather than return it unread.
