What happens when the work ends?

Access and code

I remove or hand back every access listed in the Statements of Work. I confirm each step to you in writing.

Your code stays in your repository or in a private fork that you control. I do not copy it into public repositories, public gists, public issue trackers or other clients’ projects.

I delete local clones of your repositories, private forks that I own, branches I created that you did not merge, and local environment files.

I add no telemetry, tracking or remote access code, and I add no dependency with a known critical vulnerability.

Secrets and data

I delete secrets, test keys and exports of your data from my devices and accounts. I ask you to rotate any secret that I held.

I keep AI tool session logs that contain your code or data only in an encrypted archive that I alone can open. I delete them when you ask in writing.

I keep only the documents the Agreement allows, such as invoices and the signed Agreement, for as long as the law requires.

The written deletion confirmation lists each item with the date it was done.

If something goes wrong

A security incident is any event where your code, data, secrets or access may have reached someone who should not have it.

I tell you in writing within 24 hours after I become aware of an incident. The notice says what happened, what may be affected, what I have done and what I suggest you do.

I help you contain the incident within the hours of the current week, at no extra charge if I caused it.