Every claim here, with a way to check it.

How we handle your code and data

• Source code

  Private repositories, branch protection on main, review required before merge. Client-owned repos stay client-owned; we work in yours when you have one.

• Access

  Least-privilege by default. Every credential goes through a password manager, never chat or email. Access is revoked the day an engagement ends.

• Devices

  Full-disk encryption and screen lock enforced on every machine that touches client code.

• Data handling

  We develop against synthetic or masked data. Production data is only touched with written approval and a stated reason.

• Reporting a vulnerability

  Email security@appinfinite.org. We acknowledge within one business day and tell you what we found, including when it's our fault.

Subprocessors

Third parties that can touch data on our own systems. Project-specific vendors are listed in the engagement agreement instead.

What we don't claim

• Certifications we're still working toward — they appear here the day the certificate does, not before.
• Client logos we don't have written permission to use, however well-known the name would look.
• Headcount or project numbers we can't produce a contract or a payroll line for.