Security and trust.
A plain account of how InflexDev handles your code, accounts and data, and what it does not hold. Written for your security team, so they can check it.
The facts first.
Small by design: one senior engineer and no hand-offs. Here is what that means for your review.
- Company
- InflexDev is a trade name of Inflex Dev Solutions LLC, a Delaware company.
- Who works on your project
- One engineer: the founder. No subcontractors unless you approve them in writing.
- Where the founder works
- Spain, in the EU. US business hours, remote.
- Certifications
- None. InflexDev holds no SOC 2 report, ISO 27001 certificate, HIPAA attestation or PCI validation.
- Your data
- Stays in your accounts. InflexDev runs no infrastructure that stores your customers’ data.
How I work on your systems.
The same rules on every engagement. They are written into the proposal, so they are part of what you sign.
- Repositories and cloud accounts are created in your company’s name. I work through a named user you can switch off at any time.
- Least privilege: access to what the current milestone needs, and read-only access during the review.
- Multi-factor authentication on every account I use for your work.
- Production data stays in production. Development uses synthetic or masked data unless you agree otherwise in writing.
- Secrets live in your secret manager, never in the repository, in tickets or in chat.
- Every change goes through a pull request that I review. Nothing reaches production without passing tests.
- At handover, or whenever you ask, my access is removed and the credentials I used are rotated.
How AI is used.
Agents make the drafting faster. They do not make decisions about your systems, and they do not see what they should not.
- AI coding agents draft code and help trace systems during reviews. I review every change before it merges.
- I use model providers under business or API terms that do not use your code or data to train their models. The tools used on your project are listed in the proposal.
- No customer personal data, card data or health data goes into a prompt, unless you approve a setup covered by your own agreements.
Regulated work.
InflexDev is not a compliance vendor. It builds the software your compliance program depends on.
Payments
Hosted or tokenized flows from licensed providers, so raw card numbers never touch your servers or mine. PCI validation stays with you as the merchant.
Fintech
I build on licensed rails and never hold, route or move funds. Compliance decisions stay with you, your compliance team and your partner bank.
Health data
I build to support your HIPAA program. If the work requires access to protected health information, we sign a business associate agreement first. Where possible, I design the work so I never need that access.
Location and incidents.
Your systems are accessed from Spain. If your data must not be accessed from outside the United States, tell me before the review and we will design the work around it, or I will say that it is not a fit.
If I find or suspect a security incident affecting your systems, I tell you within 24 hours, with what I know and what I have already done.
Send your security questionnaire.
I will complete it, and review your NDA, data processing agreement or business associate agreement before work starts.