Security & data protection

Who you contract with

Your contract is with Smoother Development AB (org. no. 559526-3350), a Swedish limited company, under Swedish law. A founder is accountable for every engagement. Our engineers work from Ukraine and are bound by confidentiality and IP-assignment terms in their agreements with us.

Personal data and GDPR

• If we need access to personal data in your systems, we sign a data processing agreement (personuppgiftsbiträdesavtal) before we start.
• Ukraine has no EU adequacy decision, so any access from Ukraine is covered by the European Commission's Standard Contractual Clauses in that agreement.
• We design for data minimisation: development and testing use anonymised or synthetic data wherever possible, and engineers often don't need access to production personal data at all.
• We keep a list of the sub-processors we use for your project and tell you before adding a new one.

Where your data lives

• We deploy to EU cloud regions by default, for example AWS Stockholm (eu-north-1) or Frankfurt (eu-central-1), preferably in your own cloud account.
• For AI work we use model APIs that do not train on your data (such as Azure OpenAI, AWS Bedrock or the Anthropic and OpenAI APIs under their business terms), EU-region endpoints where available, or a self-hosted model when the data must not leave your environment.
• We never use your data to train models for other clients.

Access and day-to-day security

• Least-privilege access: named accounts for each engineer, only the environments they need, removed when they leave the project.
• Multi-factor authentication on code hosting, cloud and e-mail accounts.
• Secrets live in a secrets manager, never in the repository.
• Code review on every change and automated dependency checks in CI.

Continuity

• Every project has a second engineer who knows the codebase, so one person being unavailable doesn't stop delivery.
• Code is pushed to a repository you can access at all times, infrastructure is defined as code, and we keep a runbook for anything we operate.
• Our team in Ukraine has worked through power and connectivity disruption since 2022 with backup power and connections, and we plan delivery so a short outage doesn't move a milestone.

Your intellectual property

• You own the code, designs and documentation we create for you once the related invoice is paid. This is written into the contract.
• We sign your NDA, or ours, before you share confidential details.
• When the engagement ends you get everything: repositories, infrastructure code, credentials and documentation.

Questions from your IT or security team

We're happy to answer a security questionnaire or join a call with your IT, security or data protection officer before you sign. E-mail [email protected].