What happens if we part ways.
The answers a security reviewer, a procurement officer or your counsel will ask for, published so you do not have to send a questionnaire to get them.
Ownership and handover
Source code, infrastructure definitions, and documentation are yours from day one. Handover is a documented process included in every engagement, not a negotiation that starts when the relationship ends. We can transfer to your team or to another vendor, and we will do it properly either way.
We do not hold access, credentials or repositories as a retention mechanism. If the engagement ends, the thing you paid for leaves with you in a state another team can pick up.
AI governance
Six questions buyers actually ask
If you are putting an AI system into a clinical, financial or safety-critical workflow, these are the questions your risk function will raise. Here are our answers before you ask them.
Will our data train a third-party model?
Not without explicit written agreement. Provider terms are selected accordingly and stated per engagement.
Can AI systems run entirely in our environment?
Yes. Open-weight models can be deployed on your infrastructure where residency or cost requires it.
How do you prevent harmful or incorrect output?
Evaluation harnesses, retrieval grounding with citation, output constraints, and human review in high-stakes flows.
Are AI decisions auditable?
Inputs, outputs, model versions, and decision paths are logged where regulation or debugging requires it.
What if the model degrades?
Drift monitoring against the evaluation baseline, with alerting and a defined retraining path.
Who is accountable for an AI system's output?
Defined per engagement in writing before deployment. In clinical, financial, and safety flows, a human decides.
AI in delivery
What “AI accelerated” means for your code.
Speed is a delivery claim. It is not a claim about who reviewed the code or who is accountable for it.
How do you use AI in delivery, and does it affect who owns the result?
AI-assisted review, test generation, and documentation run inside our pipeline. Every line still passes human review and our test gates. It changes how fast we work, not who is accountable. Ownership is unaffected.
What if we do not allow AI-assisted development?
We can run a segregated process on request. Tell us before the engagement starts, because it changes how the pipeline is configured rather than how a single task is done.
Do you hold ISO 27001 or SOC 2?
No. Neither certification is held today. If your procurement process requires one, tell us early so we can establish whether the controls behind it can be evidenced another way.
Reporting a vulnerability
If you have found a security issue in something we built or operate, email info@devtechguru.com with enough detail to reproduce it. We will confirm receipt and tell you what we are doing about it.
We do not run a bounty programme and we will not threaten you for reporting in good faith.
Contract terms, governing law and certification status are answered per engagement. Ask and you will get a direct answer rather than a brochure.