Working with XSIS

Access is granted per person, limited to what each role needs, and removed when that person leaves the project. We work in your repositories and environments if you prefer, use multi-factor authentication, and keep secrets in a vault, never in code. Code is reviewed before it is merged, dependencies are scanned, and production data is not copied into test environments without masking. We agree these controls with your security team at the start.

Link to this question

Where you decide. We agree the location of data before work starts and design for it, whether it must stay in one country, in your own cloud account or on your premises. Where data-protection laws such as the GDPR apply, we work under a data processing agreement and limit personal data to what the work needs.

Link to this question

Only if you agree. We tell you which tools we would use, how they handle code and data, and whether anything leaves your environment. If you prefer, we work without them. Code written with AI assistance goes through the same review and testing as any other code, and the engineer who submits it is responsible for it.

Link to this question

Each outsourced engineer is bound by the same confidentiality and security terms as our own staff, passed down in writing. Access to your systems is given per person, limited to what the role needs, reviewed regularly and removed when they leave. If you need some work done only by XSIS engineers, or only from certain locations, we plan the team that way.

Read more: In-house and outsourced teamsLink to this question

Usually read-only access to documentation, code repositories, architecture diagrams and monitoring, plus time with the people who run the systems. We do not need production data for most reviews. Access is granted to named people, under a non-disclosure agreement, and removed when the engagement ends.

Read more: Technology and architecture consultingLink to this question

Some, to judge readiness honestly. We usually need read access to samples, data catalogues or schemas, and time with the people who own the data. We do not copy data out of your environment, we work under a non-disclosure agreement, and access is removed when the assessment ends.

Read more: AI readiness assessmentLink to this question

Yes. For each use case we identify privacy, security, regulatory and ethical risks, such as automated decisions about customers, personal data in prompts or a need for explanations. We then propose controls proportionate to the risk: human review, evaluation, logging and approval steps. Legal interpretation of specific regulations stays with your legal advisers.

Read more: AI readiness assessmentLink to this question