Question 1

Do you fine-tune a custom model, or use off-the-shelf ones?

Accepted Answer

Off-the-shelf, in almost every case. For most funded startups, training a custom model is the wrong call: frontier models plus strong retrieval, prompting, and evals get you further, faster, and cheaper. Fine-tuning is a real option for narrow, high-volume tasks where you already have clean labelled data, and we evaluate that per project rather than by default.

Question 2

How do you keep an AI feature from going wrong in production?

Accepted Answer

Three layers. Evaluation suites built from representative inputs, expected behaviour, edge cases, and known failure modes, run before every release. Guardrails and safety filters at runtime. Then designed failure states: retries, degraded modes, provider failover, and human review on the paths where a wrong answer is expensive. The point is that the feature fails in a way you chose, rather than in a way you discover from a customer.

Question 3

How do you decide an AI feature is good enough to ship?

Accepted Answer

Against an eval suite your team can run, not a demo that went well. We turn the behaviour you need into repeatable tests, set the bar with you before the build, and measure against it as the feature changes. If it does not clear the bar, you find out before launch instead of after.

Question 4

What happens to the model after launch?

Accepted Answer

It gets watched. We instrument cost and latency, monitor outputs for drift, and wire runtime visibility so you can see what the feature is actually doing once real users are on it. Model behaviour moves when providers ship new versions, so an AI feature without observability degrades quietly.

Question 5

Do you use AI tools to write our code?

Accepted Answer

Yes, and we say so up front. Depending on your stack and security posture that may include Claude Code, GitHub Copilot, Cursor, model APIs, custom MCP servers, and repository-aware agents. It changes how fast we work, not the standard: code review is mandatory on every change, and a human engineer is accountable for everything that reaches your repository.

Question 6

Is our data sent to model providers or used to train models?

Accepted Answer

We avoid sending sensitive data to external model providers unless the provider offers an appropriate agreement, and we configure data-residency and zero-retention controls when supported. For health data specifically, that means a provider offering a HIPAA BAA (Anthropic, OpenAI Enterprise, Azure OpenAI, AWS Bedrock). Which controls are available depends on the provider and the tier you are on, so we confirm the specifics for your stack rather than promising a blanket answer.

Question 7

Who owns the code you write for us?

Accepted Answer

You do. You own the code, the models, the prompts, and the data. We sign IP assignments at engagement start and document the handover at engagement end, so ownership is settled before the first commit rather than negotiated at the finish line.

Question 8

When does ownership actually transfer?

Accepted Answer

As the work lands, not on final payment day. The assignment is recorded as code lands, so there is never a window where you have paid for work you do not own.

Question 9

Is there anything you keep?

Accepted Answer

One carve-out: our own internal tools and frameworks, which we license to you for ongoing use. Everything built for your product is yours by full assignment on delivery. The contract spells this out before kickoff, so nothing about it should be a surprise later.

Question 10

Do you reuse our code on other client projects?

Accepted Answer

No. Product code we write for you is assigned to you and is not carried into another engagement. The reusable layer is the internal tooling and frameworks noted above, which existed before your project and are licensed rather than assigned.

Question 11

Can you work under our contract and NDA instead of yours?

Accepted Answer

Yes. We routinely sign mutual NDAs before discussing project specifics; send yours over with your inquiry, or use ours. We sign DPAs as standard, and we are happy to work under your paper where your legal team prefers it.

Question 12

Can you sign a BAA and build under HIPAA?

Accepted Answer

Yes. We have shipped HIPAA-architected AI healthcare products, a BAA is available, and compliance is designed into the architecture from week one rather than retrofitted before launch. We are not HIPAA "certified" — HIPAA is a regulation, not a certification, and any vendor claiming a HIPAA certificate is telling you something inaccurate.

Question 13

Are you SOC 2 certified?

Accepted Answer

No, and neither is anyone else: SOC 2 is not a certification, it is an attestation report issued to a company by a licensed CPA firm. Our own SOC 2 Type II is planned, targeted for late 2026 / early 2027. What we do today is build software that supports the technical controls and evidence a SOC 2 examination tests, so that your report goes faster.

Question 14

Are you ISO 27001 certified?

Accepted Answer

No certificate is held. We build to the standard today, and we are straightforward about the difference between engineering to a standard and holding an audited certificate against it.

Question 15

Our investors are asking about compliance before we have customers. Where do we start?

Accepted Answer

Usually with the controls that are expensive to retrofit: access control, encryption, audit logging, and change management. Those are the same foundations HIPAA, SOC 2, and ISO 27001 all lean on, so building them early means one piece of work instead of three. The per-standard pages below set out what each one actually asks for.

Question 16

How do you handle our production credentials and data access?

Accepted Answer

Production credentials never touch developer machines. Code review is mandatory on every change, and access is scoped to the engineers actively assigned to your project. DPAs and NDAs are signed as standard.

How we build, who owns it, and what we can sign

Building with AI

IP and ownership

Security and compliance

Still have a question we have not answered?