How we handle access to the code that runs your business.
How we get and give back access, what we do with AI tools, what happens when something breaks, and which documents you can have before you sign anything.
No certifications
We hold no security certifications: no ISO 27001, no SOC 2 report. Instead, here are the rules we work by. If you'd like to see how we work before giving us any access, start with a Debt Check. It needs no access to your code or systems.
Who can see your code
Only the people working on your project, named in the contract and bound by the NDA. Nobody else has access to your code, your systems or your credentials.
With your consent, given in the AI annex to the contract (see How we use AI tools), parts of your code are processed by the AI providers listed under subprocessors, under the data processing agreement.
Subcontractors only with your prior written consent. If we ever propose one for your project, they sign the same NDA and data processing terms before getting access.
How we access your systems
-
Least privilege
Read-only access to the repository first. Write access, staging, CI and servers come later, one at a time, when a task needs them. We don't ask for organization-owner or billing access. Where server work needs root, we ask for
sudoon our named account, say what it is for, and give it back when the task is done. -
Separate, named accounts
You create an account for us in each system: Git hosting, CI, cloud, server. We never use a shared login or the account of a former developer. Every action we take can be traced to our named account.
-
Your infrastructure, your keys
We connect through your VPN, bastion or SSO if you have them. We use a separate SSH key for each client, and the key never leaves our device.
-
MFA on every account
Multi-factor authentication is on for every account we use for client work: email, Git hosting, cloud consoles, AI tool accounts and the password manager. If one of your systems doesn't support it, we tell you and note it in the access inventory.
-
Access inventory
A list of every access you gave us: system, account, permission level, date granted. You get a copy at any time. On Care Standard and Plus we review it at every quarterly review, on Care Basic at least once a year.
How we treat your code and data
-
Production data stays with you
As a rule, production data stays in your environment. Tests use synthetic data or an anonymized extract produced inside your environment. If a task needs a local copy, it is temporary, agreed with you first and deleted when the task is done.
-
Secrets stay out of code and prompts
Passwords, API keys and
.envfiles don't go into the repository or into any AI tool. If we find secrets already committed, we report them and recommend which ones to rotate. -
Encryption
All traffic to your systems goes over SSH or TLS. Credentials are kept in an encrypted password manager.
-
Changes through your process
Every change is a merge request in your repository, with tests and a green CI run. Where there is no CI yet, setting it up is one of the first things we do in a Takeover; until then, each merge request comes with a test note. Before any production change we confirm a current backup and document how to roll back.
-
Deletion at the end
When the engagement ends, we delete local copies of your code and any project data within 30 days and confirm it in writing. If copies remain in our encrypted backups, the confirmation says when they expire.
When the engagement ends
01
Exit kit
Repository, documentation, runbook and access inventory, at no charge, within 10 business days.
02
Credentials
We list every credential we had access to and mark the ones you should rotate.
03
Accounts closed
You remove our accounts. With your agreement we test that they are closed, and we confirm in writing that we hold no remaining access.
04
Copies deleted
We delete local copies within 30 days and confirm it.
How we use AI tools
We use AI coding tools for parts of the work: reading large codebases, drafting tests, preparing mechanical changes for an upgrade. This is part of how we can offer fixed prices. More on the method in How we work.
-
Only with your signed consent
AI use is described in a separate contract annex, the AI Tooling Disclosure & Consent, which names the tools and the providers. Without your signature, we don't use AI tools on your code.
-
Under the data processing agreement
The AI provider is a subprocessor in the DPA. Which tools we use, and on which terms, is set out in the AI annex for your project. If your policy requires commercial terms (no training on your code, limited retention), we use those. For its commercial products, Anthropic, the provider of the Claude models we use, states that by default it does not train its models on inputs or outputs from its commercial products, and that API inputs and outputs are deleted within 30 days (longer only for content flagged under its usage policy). We don't opt into longer retention, and we don't send feedback to the provider from sessions with your code.
-
EU-only processing, on request
If your policy requires processing inside the EU, we agree the setup in the annex, for example Amazon Bedrock with an EU inference profile, which keeps requests within AWS regions in the EU. AWS states that model providers have no access to prompts and completions processed in Bedrock. This option costs more; the quote says how much before you sign.
-
You can exclude parts of your code
If some repositories or directories must not be processed by AI tools, such as licensed third-party code or security modules, list them in the annex. We work on those parts without AI tools.
-
What never goes into an AI tool
Production data, personal data from your databases, secrets and credentials, and anything you excluded.
-
A person reviews every change
Nothing an AI tool produces reaches your repository without review by the engineer, tests and CI. Responsibility for the change is ours, the same as for any other line of code.
-
When AI is not an option
By default we work with AI tools, because our fixed prices rely on them. If your policy rules out both options above, we can work without AI tools. That work is priced individually.
Subprocessors
Only services that may process your code or data. The full list, with legal entities, addresses and the legal basis for each transfer outside the EU, is an annex to the DPA. It also names the password manager that holds the credentials you give us. We give 30 days' notice before adding a subprocessor, and you may object.
| Subprocessor | Purpose | Location of processing | When |
|---|---|---|---|
| Anthropic | AI models (Claude) | USA | default |
| Amazon Web Services EMEA SARL (Amazon Bedrock) | AI models (Claude) via an EU inference profile | EU | EU-only option |
| Google Cloud EMEA Limited (Google Workspace) | email for refberg.com | EU/USA | always |
When something breaks in your application
This applies to clients with a Care plan.
-
Hours
Monday to Friday, 9 am–6 pm Central European Time (CET/CEST), except Polish public holidays. Response times are the ones in your plan: next business day on Basic, up to 4 business hours for critical issues on Standard and Plus. Evenings and weekends are a paid add-on (Extended hours). We don't offer 24/7 on-call, and we won't sell you one.
-
What a response means
We acknowledge the issue and start the diagnosis. Not necessarily the fix.
-
What we do
Contain first: roll back, disable the feature, block the traffic. Then fix, then explain. You get short updates while the incident is open.
-
Afterwards
After a critical incident you get an incident report: what happened, the cause, what we changed, and what would stop it from happening again. At the latest it comes with the next monthly report.
If something goes wrong on our side
If a device of ours is lost or stolen, an account of ours is compromised, or we suspect your code or credentials may have been exposed, we tell you within 48 hours of finding out. We tell you what may be affected and which credentials to rotate, and we remove our access ourselves where we can.
This also applies during our holiday windows. The full obligations are in the data processing agreement.
Continuity: you never depend on us
You can carry on without us at any time. These rules make sure of it.
-
Everything lives in your accounts
Code, CI, documentation and credentials are in your systems, not ours. You can hand the application to someone else at any time.
-
The runbook is kept current
Deploy, rollback, backup restore, scheduled jobs, queues and monitoring are documented. The runbook is updated whenever something in it changes, and reviewed at every quarterly review on Care Standard and Plus. Another PHP developer should be able to take over from it.
-
Planned absence is announced
Up to two holiday windows a year, each up to two weeks, announced at least 30 days ahead. During a window we handle only critical security incidents, on a best-effort basis and without a response time.
-
Unplanned absence has rules
They are in the contract: the Care fee is reduced from the 6th business day of absence, and after 10 business days you may end Care at once.
-
Exit kit at no charge
If you leave, you get everything you need to continue without us.
Documents you can have before you sign
| Document | When |
|---|---|
| Mutual NDA | before we see any code |
| Data Processing Agreement (GDPR Art. 28), with subprocessor list | with the offer |
| AI Tooling Disclosure & Consent | with the offer |
| Our standard answers to a vendor security questionnaire | on request, within one business day |
| Official CEIDG printout (business register entry) | on request |
| W-8BEN (for clients in the USA) | on request |
Security questions
Can we see your security questionnaire answers before we talk?
Yes. Ask through the contact form and we send our standard answers within one business day. If you use SIG Lite, CAIQ or your own format, send it and we fill it in.
Can AI processing of our code stay in the EU?
Yes. With the EU-only option we agree an EU setup in the annex, for example Amazon Bedrock with an EU inference profile. You can also exclude named repositories or directories from AI processing altogether.
How can we check that you are a real company?
In the public Polish and EU registers. Verify us lists each register, what to enter and what you should see.
How do we report a security problem in something you built or maintain?
Write to contact@refberg.com with "Security" in the subject line.
Send your security questions first
Before anything else. You get our answers, and you read the NDA, the DPA and the AI consent before you sign anything.