Security & trust
Built to be trusted,
not just shipped.
Agents move fast; trust comes from the controls around them. A senior engineer signs off on every risky step, you own everything we build, and every change is traceable to the agent that made it.
A human signs every risky step.
Our 9-stage delivery pipeline pauses at 5 gates. Nothing sensitive — auth, payments, schema, or a final release — ships until a senior engineer reviews and approves it.
You own it — and you can prove it.
Your infrastructure, day one
We build in your GitHub organization, your Vercel project, and your database — not ours. There is nothing to migrate off later, and no account you depend on us to keep.
A provenance report
Every change is attributed to the agent that made it, what it cost, and which tests cover it — so you can audit exactly how your software was built.
A handoff runbook
You receive source, credentials, and a runbook that lets your team operate and extend the software without us. No lock-in, no hostage code.
How we handle data.
- ✓Encryption in transit across the site and services.
- ✓Access controls and reputable infrastructure providers.
- ✓Analytics load only after you opt in — no tracking cookies before consent.
- ✓Data you ask us to process during an engagement is governed by your Statement of Work and, where needed, a Data Processing Agreement.
- ✓A 30-day warranty after delivery: if a shipped feature fails materially due to our defect, we remediate it at no charge.
We rely on 8 vetted sub-processors, each listed with its purpose and processing location on our Sub-processors page. Business customers can request a Data Processing Agreement at contact@steeltoetech.io.
Report a vulnerability.
Found a security issue on this site or in something we built for you? Email contact@steeltoetech.io with the details and how to reproduce it. We investigate every good-faith report, and we won’t pursue action against researchers who act responsibly and avoid privacy violations or service disruption.