Security, IP and data protection when you outsource AI development
This page sets out how we protect your code, data and intellectual property, and what we don't have. We hold no security certifications today, so we explain what we do instead and what to ask any provider.
Your IP, your repositories
You own all the code. The IP is assigned to you and the work is committed to your repositories.
Named people only
Developers are named in the contract. No subcontracting without your consent.
Straight answers
No ISO 27001, SOC 2 or Cyber Essentials certification. We say so up front.
Is it safe to outsource AI development?
It can be, if the provider's contract and working rules close the obvious gaps. The main risks are leaked code or data, unclear ownership, unknown people in your systems and AI tools exposing your code. Ask any provider how they handle each one, and get the answers written into the contract.
Use this checklist with any provider, including us. Our own answers are in the right-hand column, including the one where our answer is no.
| Question | Why it matters | Webify.AI's answer |
|---|---|---|
| Will you sign our NDA before we share details? | It protects your plans before any contract exists. | Yes, before the first call. |
| Who owns the code you write for us? | Without a written assignment, ownership can be unclear. | You do. The IP is assigned to you. |
| Who exactly will work on our project? | Unknown people mean unknown risk. | Named developers, listed in the contract. |
| Will you pass any of the work to someone else? | Subcontracting adds people you haven't checked. | Not without your consent. |
| Where will our code live? | Code in your own repositories stays under your control. | In your repositories. |
| Will our code go into AI tools? | Some public AI tools may store what is pasted into them. | Never into public AI tools. A person reviews all AI-assisted code. |
| How will you handle personal data? | Data protection law applies to the people in your data. | Data-protection terms are agreed before a developer touches it. |
| Do you hold ISO 27001, SOC 2 or Cyber Essentials? | Some buyers need an independent check of controls. | No, not currently. |
A contract can't show everything. The section below on further questions covers the controls you should ask any provider to evidence.
Who owns the IP when I outsource AI development?
You should, and with us you do. Our contract assigns the intellectual property in all the code to you. The work is committed to your repositories, the developers are named in the contract, and nothing is subcontracted without your consent. Ending the engagement doesn't affect your ownership of the code.
| Clause | What it means for you |
|---|---|
| NDA | We sign your NDA before the first call, so you can share details safely. |
| IP assignment | You own all the code. The IP is assigned to your company. |
| Named developers | The people working for you are named and never swapped without your agreement. |
| No subcontracting | The work isn't passed to another company or freelancer without your consent. |
| AI-assisted code | A person reviews it all, and your code never goes into public AI tools. |
| Personal data | Data-protection terms are agreed before a developer touches personal data. |
This is a summary, not the contract. Ask for the full draft and have your lawyer review it before you sign.
Points worth checking in any provider's contract, ours included:
- Does ownership pass when the work is created, or only when invoices are paid?
- Does the assignment cover everything produced for you, or only the code?
- Who owns prompts, evaluation data, fine-tuned model weights and documentation?
- Which open-source licences are in the code, and do any restrict how you use it?
- Does the provider keep any tools or libraries of its own, and on what licence do you use them?
Is Webify.AI ISO 27001 or SOC 2 certified?
No. Webify.AI is not currently ISO 27001 certified, has no SOC 2 report, and holds no Cyber Essentials certificate or HIPAA attestation. Instead, we rely on contract terms and working rules. These cover the NDA, IP assignment, named developers, subcontracting, code in your repositories and AI tools. You can check each one before signing.
| Standard | What it is | Webify.AI |
|---|---|---|
| ISO/IEC 27001 | An international standard for an information security management system. Certification follows an audit by an accredited certification body. | Not certified |
| SOC 2 | An attestation report by an independent CPA firm on controls, against the AICPA's Trust Services Criteria. Type I covers design; Type II covers operation over a period. | No report |
| Cyber Essentials | A UK government-backed scheme that certifies basic technical controls against common cyber attacks. | Not certified |
| HIPAA | US law protecting health information. There is no official certification; vendors handling protected health information for a covered entity need a business associate agreement. | No attestation, and we don't claim HIPAA compliance |
If your procurement process requires one of these, we may not fit today. It's better to know that now than after the first call.
What you can ask us for instead:
- The contract clauses on NDA, IP assignment, named developers and subcontracting, before you sign.
- An interview with the named developer before they start.
- Data-protection terms, agreed before any personal data is shared.
- Written answers to your security questions, including the ones where the answer is no.
- Work under your own rules: your access policies, your tools and your AI policy.
How do you handle client data and AI tools?
Our developers use AI coding assistants where they speed the work up, such as boilerplate, tests and refactoring. A person reviews every AI-assisted change before it reaches your repository. Your code and data never go into public AI tools. If your company has its own AI policy, we follow it instead.
- We sign your NDA before the first call.
- You own all the code: IP is assigned to you.
- Developers are named in the contract and never swapped without your agreement.
- No subcontracting without your consent.
- A person reviews all AI-assisted code, and your code never goes into public AI tools.
Personal data is only touched after data-protection terms are agreed. To reduce exposure further, give developers the least data the work needs. Test data, anonymised extracts or synthetic records are often enough to build an AI feature.
Where data must never reach a third-party AI service, we build offline and on-premise LLM systems that run on your own hardware. As an IBM Partner, we also deploy on IBM watsonx and open-weight models.
What does GDPR compliant AI development involve?
No provider can make a project GDPR compliant on its own; that depends on what data you process, why and how. For offshore work, the key step is the transfer. India has no UK adequacy decision, so UK GDPR requires a safeguard to send personal data there. Examples are the IDTA and the UK Addendum.
- UK personal data: use the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.
- EU personal data: the EU GDPR has a similar rule. Transfers outside the EEA need an adequacy decision or a safeguard, such as the EU Standard Contractual Clauses.
- Contract terms: we agree data-protection terms with you before a developer touches personal data.
- Less data: share only what the work needs, and use test or anonymised data where you can.
AI features raise extra questions. Does personal data go into prompts, logs or training data? Which model provider processes it, and where? Settle these with your data protection officer at the design stage.
UK buyers will find IR35, UK GDPR and working hours covered on AI engineers for UK companies. US buyers can read about NDAs, SOC 2 and HIPAA on AI engineers for US companies.
What makes an AI development company responsible?
A responsible AI development company is clear about what its systems can and can't do. It keeps people in control of important decisions and protects the data its systems use. In practice that means evaluation before launch, guardrails, human review and clear data rules. It also means being honest about its own limits.
- Evaluation and guardrails are part of the build. Our senior AI engineers design them alongside model and retrieval choices, cost and the path to production.
- A person reviews all AI-assisted code before it reaches your repository.
- Your code and data never go into public AI tools.
- Private deployment on open-weight models or IBM watsonx when data must stay inside your network.
- Plain statements about what we don't hold: no ISO 27001, SOC 2, Cyber Essentials or HIPAA attestation.
See the kinds of AI agents we build, or how we approach offshore AI development as a project.
What else should you ask an outsourcing provider about security?
Ask about the controls a contract can't show. How are laptops and accounts secured? Who can reach your systems, and how is access removed when someone leaves? What happens after a security incident? Ask for evidence, not just a yes. We list these so you can ask them of anyone, including us.
- Are devices encrypted, and is multi-factor authentication required on every account that touches our systems?
- Are background checks carried out on developers, and to what standard?
- Has the company had an independent security audit or penetration test, and can we see a summary?
- How quickly will you tell us about a security incident, and who will contact us?
- How is access removed on the day a developer leaves our project?
- Which third-party tools will touch our code or data?
- Do you carry professional indemnity or cyber insurance, and what does it cover?
Where we can't show evidence for one of these, we'll say so. Then you can decide whether our contract terms and your own controls are enough for your project.
Because our developers work inside your systems, many of these controls are yours to set. You choose who gets access, through which accounts, and when it ends.
Frequently asked questions
Can we use our own NDA?
Yes. We sign your NDA before the first call, so you can describe the project in detail.
Can a developer be swapped without us knowing?
No. Developers are named in the contract and never swapped without your agreement.
Do you use subcontractors or freelancers?
Not without your consent. The developers named in your contract do the work.
Where is the work done?
In India, by Webify.AI. We are an AI and software company headquartered in Ahmedabad.
Will our code be used in public AI tools?
No. Your code and data never go into public AI tools. If your company has a stricter AI policy, we follow it instead.
What happens to our code and access when the engagement ends?
The code stays in your repositories and the IP remains yours. Because access runs through your systems, you can remove it on the last day.
Will you sign data-protection terms?
Yes. We agree data-protection terms with you before a developer touches any personal data.
Can you work on projects involving health data?
Talk to us before sharing any. We hold no HIPAA attestation, so your compliance team decides whether a business associate agreement is needed and whether the set-up is suitable.
Is Webify.AI an IBM Partner?
Yes. Webify.AI is an IBM Partner and deploys AI systems on IBM watsonx. Being an IBM Partner is not a security certification.
Can we see your contract before we commit?
Yes. Ask for the draft, and have your lawyer review it, before you sign anything.
Send your requirements and your security questions
Tell us the role and when you need someone. We'll email two named engineers with their experience and availability within 48 hours, and you choose who to interview.
- No cost to receive profiles
- Two-week trial with the developer you choose. No charge if you stop within the first five working days.
- Invoiced in USD or GBP; IP assigned to you.