Skip to content
Faomu
Assurance

Answers for your security team.

A supplier that builds internal systems is trusted with access, data and continuity. This page answers what your security, legal and procurement teams will ask.

Supplier summary
Access
Through your identity provider
Data
Stays in your environment
Code
Your repository
IP
Assigned to you
Contract
Your MSA, usually
Jurisdiction
England and Wales
01 — Controls

How we handle access, data and the code.

01

Access

We work inside your environment, on your terms, and leave nothing behind.

  • Accounts are issued through your identity provider, with your multi-factor policy.
  • Access is limited to the systems a stage requires and reviewed at every gate.
  • Production access is time-bound and logged in your audit trail.
  • All access is revoked at handover, and we confirm it in writing.
02

Data

Your data stays where you have decided it should be.

  • Production data does not leave your environment or your chosen region.
  • Development and testing use synthetic or masked data.
  • No customer data is stored in our own tools, chat or ticketing systems.
  • Personal data is handled under UK GDPR, with a data processing agreement where needed.
03

Engineering practice

Security is part of the specification, agreed before the first line of code.

  • A threat model is written with the specification and updated as the system changes.
  • Every change is reviewed by a second engineer before it is merged.
  • Dependencies are scanned automatically; secrets never enter the repository.
  • Infrastructure is defined as code, so every environment can be rebuilt and inspected.
04

Continuity

The system must outlive the engagement, and it must not depend on us.

  • You hold the repository, the cloud accounts and every credential.
  • We use established open technologies. There is no proprietary Faomu framework to license.
  • At least two of our engineers know every system we build.
  • Documentation is written during the build, alongside the code it describes.
02 — Questions

What procurement asks.

If your question is not here, send it to [email protected] and we will answer it in writing.

01Will you work under our master services agreement?

Usually, yes. We read it during Specification and list any clauses we need to discuss before work starts, not after.

02Who owns the intellectual property?

You do. Code, documentation and designs produced for you are assigned to you. We keep only general know-how and any open-source tools we published before the engagement, which you may use without restriction.

03Do you use AI tools when writing code?

Yes, under the same rules as any other tool. No code or data of yours is sent to a service you have not approved, every generated change is reviewed by an engineer, and you can require that we use none.

04Will you complete our security questionnaire?

Yes, in full and in writing, including the questions where the answer is no. If a control you require is not yet in place, we say so and tell you what we would do about it.

05Can our own engineers join the team?

Yes, and we recommend it. Engineers who help build a system take it over far more easily than those who receive it at the end.

06What happens if Faomu stops trading?

Nothing stops working. You already hold the code, the infrastructure, the credentials and the documentation. That is the point of the way we work.

Send us your questionnaire.

We would rather answer your security team's questions before the first meeting than after the last one.

Contact us