We treat your systems and your data as things we are borrowing. We hold no certifications: we build against public standards, state our coverage, and publish the evidence so you can check it.
We work either way. If you have an existing cloud environment, we build inside it using accounts you provision, scoped to what the work requires and nothing more. If you are starting from scratch, we build in a dedicated environment on our side and hand the whole thing over, infrastructure as code, accounts, and documentation, so that what you receive is yours outright, with no dependency on us to run it.
Access is granted per project, per person, at the minimum level the work requires. We do not share accounts between team members or between clients. We do not use long-lived credentials: access is granted through short-lived, automatically expiring tokens via workload identity federation rather than downloaded key files, so there is no permanent credential to leak, rotate or forget. Where you provision our access, you retain the ability to see and revoke it at any time without going through us.
Credentials live in a managed secret store, Google Secret Manager or the equivalent in your environment. They are never committed to source control, never placed in prompts or model context, never sent over chat or email, and never held in local files. Automated secret scanning runs against our repositories on every change, and findings block the merge rather than generating a report nobody reads.
We use the minimum data required to do the work. Where an AI system must be built and evaluated against real data, which is usually unavoidable, because a system tested only on synthetic data has not really been tested, we agree the scope with you in advance, minimise what is used, and prefer redacted or masked datasets where the use case allows. Personally identifiable information is stripped or masked wherever it is not essential to the behaviour being built. Your data is never used to train third-party models. Where we use AI tooling in development, we use configurations that exclude your data from provider training.
System logs are configured to exclude sensitive content. Where model inputs and outputs are logged for debugging or evaluation, sensitive fields are redacted before they are written. Cloud audit logs are retained and protected against modification by the identities they record.
Our access is revoked at handover, unless you ask us in writing to keep it for the Run step (modulariti Care). If you would prefer we retain access for future work, that is your decision to make explicitly, in writing, rather than something that happens by default. Working copies of your data are deleted at project close.
Source: genai.owasp.org
Source: csrc.nist.gov
Source: csrc.nist.gov
Source: slsa.dev
Source: nist.gov
Source: cisecurity.org
The OWASP risks in our own words, with the control we apply and its status.
| Risk | Status | Note |
|---|---|---|
| Hidden instructions in content the system reads | Implemented | Instructions and content kept structurally separate. Retrieved content is treated as data, never as command. Tool calls validated against an explicit schema and permission set before execution. |
| Sensitive data appearing in output or logs | Implemented | Secrets never enter prompts or model context. Inputs and outputs filtered. Logs scrubbed before they are written. |
| Compromised models, datasets or packages | Implemented | Models obtained from verified sources. Serialised model files from untrusted origins are never loaded. Dependency inventory on every release, covering model components as well as packages. |
| Corrupted training or retrieval data | Scoped | Where a project involves fine-tuning or client-controlled training data, provenance and integrity are established before use and behaviour is evaluated before and after. Where a system runs on hosted model APIs without fine-tuning, this sits with the provider. |
| Model output used unsafely downstream | Implemented | Output treated as untrusted input everywhere. Never passed into code execution, queries, shell commands or rendered markup without validation and escaping. |
| Agents able to do more than the task requires | Implemented | Narrowest capability that accomplishes the task. Each agent has its own identity and credentials. Tool access explicitly enumerated. Irreversible, costly or externally visible actions gated behind human confirmation. |
| System prompt extracted | Implemented | Nothing secret lives in a system prompt. No security property depends on a prompt staying hidden. |
| Retrieval reaching data the user should not see | Implemented | Access control enforced at retrieval time. Tenant isolation in the vector store. Ingestion sources controlled. |
| Confident wrong answers | Implemented | Answers grounded in retrieved sources with citation back where feasible. Evaluated against a task-specific test set before release, and the evaluation delivered to you. |
| Runaway cost and consumption | Implemented | Rate limits, token ceilings, loop bounds and spend alerts configured before production. |
For agent systems, additionally
| Risk | Status | Note |
|---|---|---|
| Poisoned agent memory | Implemented | Persisted state treated as untrusted on read. |
| Agents trusting each other blindly | Implemented | Output from one agent validated before another acts on it. |
“Scoped” means the risk applies only to certain projects, and we say which case yours is during the Assess step.
Our pipelines meet SLSA Build Level 3. The build platform is hardened, builds are isolated from one another, and signing material is not reachable from any build step the code itself can influence, provenance is generated by an isolated workflow the calling build cannot alter, with keyless signing.
Every artifact we ship carries a signed record of what source it was built from, by which pipeline, and when. Every release carries a software bill of materials listing every dependency it contains.
Run it yourself against anything we deliver.
$ slsa-verifier verify-artifact modulariti-api-1.4.2.tar.gz \
--provenance-path provenance.intoto.jsonl \
--source-uri github.com/modulariti/api
Verified signature against tlog entry index 84512309
Verified build using builder "slsa-github-generator@v2.1.0"
PASSED: SLSA verification passedNone. Nothing on this page is a certification, legal opinion or audit report. Where you need audited assurance, we find that out at the Assess step and work with you or an independent assessor.
Our engineering standard, and the coverage stated in the matrix above. Written down, versioned, and public, but assessed internally, not audited.
Build provenance, dependency inventories, signed artifacts, and the evaluation results delivered with each system. These need no trust in us at all. Check them with your own tooling.
If you find a security issue in something we built, tell us at info@modulariti.ai. We will acknowledge within one to two business days, and give you an assessment and our intended action within seven to ten business days. We extend safe harbour to security researchers acting in good faith: if you report a vulnerability responsibly, we will not pursue action against you for finding it. We do not currently run a paid bounty programme.
A completed security questionnaire, a data-processing addendum and a subprocessor list are available under NDA.
30 minutes, no cost, no obligation. Tell us what's slowing your business down, and we'll tell you honestly if and how we can help.
