Security, IP & compliance
Security, IP, and repo access are scoped before the engineer starts.
Devlyn engagements are designed around NDA, IP assignment, scoped access, buyer-controlled repositories, communication boundaries, and practical AI delivery governance.
How does Devlyn handle repo access?
Devlyn works within buyer-controlled repositories and systems. Access, data boundaries, communication channels, NDA, IP assignment, and AI tool rules should be agreed before onboarding.
Before onboarding
What gets scoped first.
- NDA and IP assignment
- Repository and system access scope
- Communication channels and review cadence
- Data boundaries and sensitive-source rules
- AI tool/model access policy
- Offboarding and access removal expectations
Source code stays in buyer-controlled systems.
The engineer works inside your repo, review process, issue tracker, and access policy.
Sensitive data boundaries are explicit.
Use approved datasets, environments, masking rules, and model access paths.
Model and agent usage follows buyer policy.
Prompt data, logs, tool calls, and approvals should be visible in the workflow.
Responsibilities
Clear ownership reduces security ambiguity.
Buyer responsibilities
- Define access rules
- Approve repositories and systems
- Set data and model policies
- Control permissions and offboarding
Devlyn responsibilities
- Match role to security context
- Support scoped onboarding
- Respect buyer boundaries
- Escalate unclear access or data risks
Careful claims
No unverified compliance badges.
Devlyn supports buyer security rules, scoped access, NDA/IP assignment, and buyer-controlled repositories. This page does not claim SOC 2, ISO, HIPAA, GDPR, or other certifications unless those are verified in official company materials.
FAQ
Security and IP questions.
Who owns the IP?
IP assignment is scoped before onboarding. Work is intended to be assigned to the buyer under the agreed engagement terms.
Can engineers work in our repo?
Yes. Access is scoped to buyer-controlled repositories, systems, and approval rules.
How is source code protected?
Access, review process, communication channels, and offboarding expectations are agreed before the engineer starts.
How is sensitive data handled?
Sensitive data boundaries are defined by the buyer’s policy. Devlyn works inside the approved access model and avoids unnecessary data exposure.
How are AI tools governed?
Tool usage should follow buyer policy, including model access, prompt/data boundaries, logging expectations, and approvals.
Can access be removed?
Yes. Access can be removed or changed according to buyer policy and offboarding rules.
Do you claim SOC 2, ISO, HIPAA, or GDPR compliance?
This page does not claim those certifications. Any formal compliance requirement should be verified in official company materials before contract signature.
What is the buyer responsible for?
The buyer controls repo permissions, data access, security policy, approvals, and environment boundaries.