Modern tools. Unchanged standards.
We use modern AI tools to take the repetitive work off our engineers, so their time goes into architecture, security, and review. The standards don't move. Every line is owned by a person who can explain it.
What AI actually changes
Where it genuinely helps
AI is good at the mechanical middle of the job: setting up services, drafting tests, proposing migrations, writing documentation, and handling large refactors. This is work that used to eat a large part of an engineer's week and rewards speed more than judgment.
Where it changes nothing
It doesn't decide your architecture. It doesn't choose a data model, sign off on a security review, or judge whether a trade-off suits your business. Those calls need context and accountability that no tool carries. Our engineers make them, exactly as they did before.
AI moved the typing. It did not move the thinking, and it never moves the responsibility.
We treat AI tools the way we treat cloud.
We work across AWS, Azure, and Google Cloud and choose the one that fits your business, your stack, and your constraints. We don't push a favourite and we don't lock you in. Our view of AI tooling is exactly the same.
Our engineers are hands-on across all of them. Which one we reach for depends on the task, the toolchain you already run, and above all your policy. If your security team has approved some tools and not others, we work inside that list. If they've approved none, that's a supported way of working too.
Most of our work runs through Claude Code, so it's the clearest example to walk through. The guardrails below apply whichever tool is in play.
How we use Claude Code
What it does
- Sets up services, modules, and boilerplate to our internal patterns
- Drafts tests, which an engineer then reviews and extends
- Proposes migrations, which a human approves or rewrites before they run
- Handles large mechanical refactors, in reviewable steps
- Writes documentation, runbooks, and API references
- Explains legacy code, so modernization starts from understanding
What it never does
- Touch production. Ever.
- Read production databases or live customer data
- See secrets, API keys, or .env files, excluded at the tool level
- Merge its own work, approve a pull request, or skip a review
- Run destructive commands unattended
- Make an architecture, schema, or security decision without an engineer owning it
How we keep it safe
Secrets and keys
The risk: The fastest way to leak a credential is to let a tool read a file it never needed.
Secrets live in a manager such as Vault, AWS Secrets Manager, or Doppler, never in the repo. AI tools are configured to exclude .env, credential files, and infrastructure directories by design. We prefer short-lived, role-based credentials over static keys, and run secret scanning (gitleaks, TruffleHog) as a pre-commit hook and a CI gate, so a commit carrying a key can't reach the branch.
Database schema and migrations
The risk: A generated migration that looks right and quietly loses data.
Schema is a human decision. An engineer models the data around how it will really be queried and owns that design. A tool may draft a migration; it never runs one. Every migration is versioned, reversible, peer-reviewed, and rehearsed against a copy of the data before it goes near production.
Your data
The risk: Sensitive data ending up somewhere it shouldn't.
Development and testing run on synthetic or masked datasets. Real customer data doesn't enter a developer environment, so it never enters a tool's context. Where a task needs production-shaped data, we generate it, same schema, same edge cases, none of the people.
Code review
The risk: Code nobody actually understands reaching production.
Every change, AI-assisted or not, goes through the same pull request, the same reviewer, and the same standard. An engineer must be able to explain and defend every line they submit. Code nobody can defend does not merge.
The pipeline
The risk: Speed quietly eroding quality over months.
Quality is enforced by machines, not memory. Every commit runs linting, type checking, static analysis, dependency and vulnerability scanning, and the test suite. Coverage thresholds block a merge. Security findings block a merge. The gates are identical whether a human or a tool drafted the change.
Dependencies
The risk: A generated import pulling in an unvetted package.
Dependencies are pinned and lockfiles committed. New packages need review. Automated scanning flags known vulnerabilities on every build, and we produce an SBOM where you need one.
If you'd rather we didn't use AI at all
Some clients work under rules, or preferences, that put AI tooling out of scope. That's a fair position, and we support it in writing rather than by promise.
AI-accelerated
DefaultModern tooling used inside the guardrails above, under enterprise terms with retention disabled. Fastest delivery, standards unchanged.
Restricted context
ScopedAI tooling allowed but scoped: no proprietary business logic, no regulated code paths, no client repositories in context. Used only on isolated work like tests, docs, and scaffolding.
AI-free
Human-onlyNo AI tooling touches your codebase. Fully human engineering, guaranteed as a contract addendum, and auditable. We adjust timelines honestly and tell you what the difference is up front.
Whichever tier you choose, the same commitments hold. Your code and data stay inside your boundary or ours as agreed, never in a public tool, never in a consumer account, and never used to train anyone's model. We'll work inside your cloud or VPC where you need it, and sign a DPA that says so.
We're not going to claim a multiple.
The gain shows up in lead time, how long a change takes to go from agreed to live, not in lines of code per day. Setup, tests, migrations, refactors, and documentation move much faster. Architecture, security review, and design decisions take exactly as long as they always did, because rushing those is how projects fail.
The net effect is that our engineers spend far more of their week on the work that actually needs a human. That's where the speed comes from. The standards didn't get lighter, the busywork stopped eating the people who should be thinking.
If going faster meant shipping code nobody understands, we'd go slower. That's not a slogan. It's why the review gate has no exceptions.
What we hold ourselves to
Engineering claims are cheap. These are the measures we track on every engagement and report back to you.
Delivery
Quality and security
If a measure matters to you and isn't here, tell us and we'll track it.
Engineering FAQ
Does AI write our code?
It drafts parts of it: setup, tests, migrations, refactors, docs. Every line is then reviewed, and often rewritten, by the engineer who signs their name to it. Nothing merges that a person can't explain.
Could our source code be used to train a model?
No. We work under enterprise terms with retention disabled and never use consumer AI accounts for client work. If you want that in the contract, we'll put it there.
Do your tools ever see our production data?
No. Development runs on synthetic or masked data, so real customer records never reach a developer environment.
How are keys and credentials protected?
They live in a secrets manager, never in the repo. Credential files are excluded from AI tools at the tool level, and scanning blocks any commit carrying a key.
Can we opt out of AI tooling entirely?
Yes. It's a contractual commitment, not a verbal one, and we'll be straight about what it means for the timeline.
Does moving faster mean lower quality?
The gates don't change. Coverage, static analysis, scanning, and human review apply to every change however it was drafted.
Can you work inside our cloud, VPC, or on-prem?
Yes, where your policy needs it.
Who is accountable if something breaks?
We are. Every change has a named owner, and we stay accountable for how the system performs in the real world.
Want to see the standards before you commit?
We'll walk you through our practices, our AI use policy, and the guardrails in detail. And if you'd rather we didn't use these tools at all, we'll tell you exactly what that changes.