Trust

What we do with your code, your data and your secrets.

The page your security and procurement people read before they let us in. What we practise today, what we sign, and what we send on request. No badges we do not hold.

Who you contract

One company, one contract

DIGI117 Ltd., a British Columbia company. 595 Burrard St, Vancouver, BC V7X 1L3, Canada. You contract DIGI117, and DIGI117 answers for the work of everyone it puts on your project.

Large programs run together with our sister company, Intersog, under one written agreement. When your procurement needs a vendor with insurance certificates on file, Intersog holds the contract and provides them. The same goes for health data: when your project needs a HIPAA business associate agreement, Intersog holds the contract and signs it.

On request

  • Certificates of insurance, through Intersog
  • A HIPAA business associate agreement, through Intersog
  • Sample master services agreement
  • Our answers to your security questionnaire
  • The vendors that will touch your data on your project
  • A data processing agreement, when you need one

Before work starts

Paper first, access second

  1. We sign an NDA before any scoping conversation
  2. We ask for read access to code only after the NDA
  3. The scope, the people and their levels are agreed in writing
  4. The vendors that will see your data are named in the proposal

Your code

It is yours from the first commit

The code lives in your repositories from day one. Intellectual property transfers to you in full on final payment. When the work ends, our access ends with it.

Your data

It stays in your accounts

  • We work in your cloud accounts and your region, Canada and the US included, where the provider offers it
  • Access is per person and per agent, and every access is logged
  • No production data on laptops; test data is generated or masked
  • Secrets live in your secret store, never in a repository or a chat

AI

Agents work under the same rules

  • AI vendors on terms that exclude training on your data
  • When data cannot leave, open-weight models run in your cloud or on your site
  • A person reviews every change an agent makes before it ships
  • AI spend is capped and billed at cost, on its own invoice line

What we do not claim

No borrowed badges

We do not hold SOC 2 or ISO 27001 today. If your process needs them, we answer your security questionnaire in writing instead, and you decide.

Accessibility: what we build targets WCAG 2.2 AA, and we test it on real devices.

When something goes wrong

You hear it from us first

If we find a security issue in your system, we tell you the same day, in writing, with what we know and what we do next.

Working hours are Monday to Friday, 8 am to 5 pm Pacific. We do not run 24/7 on-call today. Every fix we ship carries a 30-day warranty: if it breaks as built, we fix it at no charge. Ongoing support is quoted per month.

Need the documents?

Tell us which ones and for which project. We send them within two business days.

Request documents

Reply within one business day · No sales sequence, no spam