Trust & Security

1. Who you are contracting with

• Codavyn LLC, a North Carolina limited liability company. US-owned, US-based, no offshore staff.
• Registered in SAM.gov for federal contracting. CAGE 1AUN0. UEI SHW4DNRYP447.
• Technology Errors & Omissions, Cyber Liability, and general business insurance are in force. Certificates of insurance are provided on request.
• Every engagement starts under a mutual NDA before any material changes hands.

2. How your material is handled

• Isolated per engagement. Each client's material lives in a dedicated, isolated cloud environment. Nothing is shared between clients, and no client data is stored in Codavyn's internal systems.
• Your cloud, your ownership. We can build in a dedicated engagement environment and hand over, or work inside your own cloud from day one. Either way, you own what runs it.
• No cross-client reuse. Code, designs, and specifications built for one client are never reused, quoted, or referenced in another engagement.
• Destruction at close, in writing. When an engagement ends, deliverables are handed over, the environment is decommissioned, and destruction is attested to you in writing.
• US data residency by default, unless your contract specifies otherwise.

3. Security controls

A summary. Detailed control descriptions are provided to your security team under NDA.

• Multi-factor authentication on every account. Access is granted per engagement and per role, and removed promptly when a role ends.
• Encryption in transit and at rest for all client material, including backups.
• Credentials are held in managed secrets stores and never in source code.
• Environments are provisioned from a reviewed, version-controlled baseline with audit logging enabled.
• Code is screened against the OWASP Top 10, and dependencies are audited before delivery.

4. How we use AI

• No training on your data. AI vendors are used only under commercial terms that prohibit training on inputs, with zero-retention access for engagement work. Consumer and free-tier AI accounts are prohibited for client work.
• Your models are yours. Anything trained on your data belongs to you and is never used for another client.
• A person reviews every AI-generated output to the same standard as work written by hand before it reaches you. This is a contractual commitment in our Master Services Agreement.
• Tooling is disclosed and can be restricted in your agreement.

5. Compliance posture

• Framework alignment. Our security program is aligned to recognized frameworks (CIS Controls and NIST guidance), and our AI governance work aligns to the NIST AI Risk Management Framework.
• SOC 2: readiness, not a report. We operate a SOC 2 readiness program. No SOC 2 examination has been performed and we do not claim certification. We will pursue a Type II examination when a client contract requires it.
• Federal. Basic safeguarding practices under FAR 52.204-21 are in place. CUI handling and CMMC assessment are pursued when a contract requires them.

6. Incident response

We maintain a defined incident response process covering containment, evidence preservation, notification, remediation, and post-incident review. Client notification follows the timelines in your agreement, and one named person communicates with you throughout.

7. Commercial safeguards

• Fixed price, paid on acceptance. Each statement of work is fixed-price and milestone-based.
• You own it. The platform, the models, the data, and the intellectual property in deliverables are assigned to you.
• Permissive licences only in deliverables, unless you approve otherwise in writing.
• Operability is part of the deliverable. Every system ships with a runbook and a named patching owner.

8. Subprocessors, questionnaires, and disclosure

Engagement environments run on Amazon Web Services. AI model access is provided through Anthropic via Amazon Bedrock under no-training, zero-retention terms. The full subprocessor list is provided with our data processing agreement.

This website uses GoDaddy (hosting), Google Analytics, LinkedIn Insight Tag, Formspree (contact form), and Calendly (scheduling); none of these see client material. Details are in our Privacy Policy.

Security questionnaires, certificate of insurance requests, NDA requests, and vulnerability reports about codavyn.com reach us at support@codavyn.com. Good-faith researchers who give us a reasonable window to fix an issue before disclosure will not be pursued.