Trust and delivery practices

Access to systems

A designated accountable role within our System Admin team approves access. Multi-factor authentication is required in sensitive cases. When someone leaves, access is removed as part of the handover and verification process.

Confidentiality and client data

Non-disclosure agreements are standard. We obtain written permission from the client before using client data. We do not use client data without permission for work unrelated to that client, including AI training.

Code and IP responsibility

A designated accountable role within our DevOps team handles code and intellectual property ownership matters. This role typically reports to the delivery lead. If an outside delivery partner is involved, settle who controls code when an agency builds before work starts.

Production releases and incidents

Reviews take place before production releases according to the agreed pre-release review process. The designated project leader handles incidents and client notification.

Handover and retained data

Documentation, credentials, and support are provided according to the agreed scope of work. Retained client data and copies are handled according to the scope of work and maintenance contracts.

Use these practices in your delivery review

Use this page to identify the access, confidentiality, release, and handover questions to settle before work begins. Your delivery owner should bring required controls to the review; the relevant UCS accountable role can address how they apply to the proposed scope.

If your engagement requires specific repository control, IP terms, notification deadlines, retention periods, or support coverage, agree on those in the contract and operating scope. This page is not a substitute for those terms or evidence of a certification. If a required control remains unresolved, settle it before granting the affected access or relying on that service.

For website visits and initial correspondence, the Privacy notice is the relevant reference. Delivery access and client-system responsibilities need an engagement-specific review.

Website privacy

For information about website data and initial correspondence, read our Privacy notice.

Questions before we start

Who approves access to client systems?

UCS access approval sits with a designated accountable role in the System Admin team. Multi-factor authentication is required in sensitive cases. Access removal is part of handover and verification when someone leaves; engagement-specific access requirements should be agreed before access is granted.

Can client data be used for AI training?

UCS obtains written client permission before using client data. Client data is not used without permission for work unrelated to that client, including AI training. Agree on the permitted purpose before supplying data.

Who owns commissioned code and IP?

Code and IP ownership must be settled in the engagement terms. A designated accountable role in the UCS DevOps team handles ownership matters and typically reports to the delivery lead. That operational role alone does not establish contractual ownership or control of repositories or cloud accounts.

Who handles production incidents and notification?

The designated UCS project leader handles incidents and client notification. Production releases follow the agreed pre-release review process. Required notification deadlines, response coverage, and escalation responsibilities need to be agreed for the engagement; this page does not promise a service level.

What is included in handover and retained-data handling?

UCS provides documentation, credentials, and support according to the agreed scope of work. Retained client data and copies are handled according to the scope and maintenance contracts. Specific handover contents, support boundaries, and retention requirements must be settled in those agreements.

Bring your delivery requirements

Bring a nonconfidential control checklist, the types of systems involved, required access boundaries, and any handover or notification requirements. Include the decision owner for security and contractual terms. Do not send credentials, confidential contracts, client data, or security incident dumps in the initial inquiry.

Discuss your delivery requirements →