Security review

Access is scoped to the workflow

Before Applied Crew accesses any system, we agree in writing on permissions, environments, data retention, secret handling, logging, approval points, and incident ownership. Access is limited to the systems and records the agreed workflow requires, using the least privilege that can support it.

Data flow and model providers

What the system may do:

What requires a person:

Customers should understand which models are used, what data those models receive, where the data is processed, how long it is retained, and how a model change is evaluated before it reaches production. Applied Crew is model-neutral and selects providers according to the task, the data policy, and the customer's constraints.

Controls agreed before launch:

Read and write scopes for every connected system, recorded per environment.
Approval points for any action that is customer-facing or hard to reverse.
Audit logging of actions taken, evidence used, and corrections made by operators.
Retention and deletion rules for prompts, outputs, and any stored context.
A named owner on both sides for incidents and for rolling a release back.

During technical diligence:

Current documentation is available on request.

Read and write scopes for every connected system, recorded per environment.
Approval points for any action that is customer-facing or hard to reverse.
Audit logging of actions taken, evidence used, and corrections made by operators.
Retention and deletion rules for prompts, outputs, and any stored context.
A named owner on both sides for incidents and for rolling a release back.

Applied Crew does not publish certification badges before a certification is complete. We will describe the controls that are in place today and the ones that are not.