Security and IP
What you own, and how we handle it
A mutual NDA before details are shared, full intellectual property assignment at delivery, and security practice described accurately rather than dressed up as certification.
- IP ownership
- 100% yours at delivery
- Confidentiality
- Mutual NDA before project details are shared
- Certifications
- None claimed. We describe practice, not badges.
Ownership
Intellectual property
The client owns one hundred percent of the intellectual property in everything built for them. That includes the source code, the database schema, the design assets, the documentation and the deployment configuration. The assignment is written into the engagement agreement rather than implied, and it takes effect at delivery.
Sawhorse retains no licence to reuse what was built for you. Third party open source components remain under their own licences, as they do in any software, and the handover documentation lists them so your legal team has the complete position rather than a surprise later.
Infrastructure follows the same principle. Domains, hosting, databases and third party services are registered to accounts you own, so changing supplier is an access change rather than a migration.
Confidentiality
Mutual NDAs
Signed before project details are shared, covering both directions.
- Before discoveryA mutual NDA is signed before you describe your operation in detail. It is the default rather than something you ask for.
- Both directionsA mutual agreement covers your commercial information and our technical approach in one document.
- Your paper is fineWe review your template and raise anything that needs discussion rather than insisting on ours.
- No public namingWe name a client publicly only with written permission. Several case studies on this site describe delivered work without naming anyone.
Practice
Access control and secrets
What we actually do, stated plainly enough that you can hold us to it.
| Least privilege | Access is granted per person for the duration it is needed and removed at the end of the engagement |
|---|---|
| Secrets storage | Platform secret stores scoped per environment. Never in a repository, a ticket or a chat thread |
| Key rotation | A documented rotation procedure handed over in the runbook, including who holds what |
| Environment separation | Development, preview and production hold separate data and separate credentials |
| Production data | Not copied into lower environments. Testing uses masked or seeded data |
| Transport | TLS everywhere, with databases reachable only on a private network where the platform supports it |
| Dependency review | Dependencies are chosen deliberately and kept current, because every one is a supply chain decision |
| Audit logging | Systems we build record who changed what and when, which is the only reliable answer after an incident |
| Cardholder data | Never touches your systems or ours. Payment integrations use processor hosted fields or a managed checkout |
Data protection
GDPR alignment for European clients
We build for the obligations rather than claiming compliance on your behalf. Your own advisers confirm what applies to your organisation.
| Data minimisation | Systems collect what the purpose requires and no more, decided during the specification |
|---|---|
| Purpose limitation | Each category of personal data has a recorded purpose in the architecture documentation |
| Retention | Retention rules set per data category, with automatic disposal where the purpose has ended |
| Subject access | Export of a data subject record built as a function rather than as a manual query |
| Erasure | A defined deletion process covering derived data, backups and logs |
| Residency | Storage and processing region chosen with you and recorded |
| Processors | Third party services used by the system are listed with what they process |
| Consent gating | Non essential scripts and tracking blocked until consent is recorded |
We hold no SOC 2 report, no ISO certification and no PCI certification, and we will not imply otherwise to win work. Where your procurement requires a certified supplier, we will tell you that directly rather than let you find out during an audit.
FAQ
Security and IP questions
Do you hold SOC 2, ISO 27001 or any other certification?
No. We do not claim certifications we do not hold. This page describes our actual practice, which you are free to audit against your own requirements.
Who owns the intellectual property?
You do, completely. One hundred percent of the IP, the full source code and all documentation transfer at delivery. Sawhorse keeps nothing.
What about open source components?
They remain under their own licences, which is true of any software. The handover documentation lists them and their licences so your legal team has the full picture.
When is an NDA signed?
Before project details are shared. A mutual NDA is our default rather than something you have to request.
Where is our data stored?
In infrastructure and accounts registered to you, in the region you choose. The architecture documentation records where each category of data is stored and processed.
Do you access our production data?
Only where an engagement requires it and you have granted it, under least privilege and with access removed at the end. Development and testing use masked or seeded data.
How do you handle a security issue found after delivery?
Report it to support@sawhorsesoftware.tech. We acknowledge it, assess it against the delivered system, and tell you what we find and what we recommend, whether or not you hold a support plan.
Can you meet our security questionnaire?
We answer questionnaires honestly, including where the answer is that a control is not in place. We will not claim a certification or a control we do not have in order to pass one.
Let’s talk about the system you need.
Tell us where the current process breaks down. We can map the workflow, examine the integration requirements and define a practical scope for the build.
- A mutual NDA is signed before project details are shared.
- Scope is fixed in writing before any build starts.
- You own the source code, the IP and the documentation at delivery.
- Support plans are available and tailored on a discovery or technical call.