Trust Center
Security and conduct policies
Remote Pro Ai runs on 11 written policies covering security, data protection, AI use and engineer conduct. Each is summarised here; full texts are shared under NDA once issued.
In short
Remote Pro Ai runs on 11 written policies that govern security, data protection, AI use and engineer conduct. Each one is summarised below in plain language, with its version and last review date. The full policy documents are in preparation and will be shared under NDA once issued, so your security team can check the exact wording.
Index of security policies
| Policy | Version | Last reviewed |
|---|---|---|
| Information security | 1.0 | 1 October 2026 |
| Access control | 1.0 | 1 October 2026 |
| Acceptable use | 1.0 | 1 October 2026 |
| AI usage | 1.0 | 1 October 2026 |
| Data protection & privacy | 1.0 | 1 October 2026 |
| Secure development | 1.0 | 1 October 2026 |
| Incident response | 1.0 | 1 October 2026 |
| Business continuity | 1.0 | 1 October 2026 |
| Vendor management | 1.0 | 1 October 2026 |
| Anti-bribery | 1.0 | 1 October 2026 |
| Engineer code of conduct | 1.0 | 1 October 2026 |
What each policy means in practice
- Information security: a named security lead owns the programme; risks are logged and reviewed; controls follow ISO/IEC 27001.
- Access control: SSO and MFA everywhere, least privilege by default, access removed the day an assignment ends.
- Data protection & privacy: we process client data only on documented instructions, in the region you choose.
- Secure development: every merge is reviewed by a senior engineer; secrets and dependency scanning run on every commit.
- Incident response: incidents affecting client data are notified within 24 hours, with a written postmortem.
- Business continuity: 2 delivery offices (Cairo and Al-Khobar) and 4 standbys per seat keep squads running through disruption.
- Vendor management: subprocessors sign DPAs; clients get 30 days' notice of changes.
- Anti-bribery: no gifts, payments or favours to win or keep business, in any country.
Full policies
Full policy documents are in preparation. Request them from the document register and we share them under NDA once they are issued.
How policies are maintained
Every policy is reviewed at least once a year and after any significant incident or regulatory change. Material changes are posted on the updates feed.
Acceptable use and AI usage
- Only company-approved AI tools, in zero-retention or enterprise modes.
- No client code, data or credentials in consumer AI tools, ever.
- AI-assisted changes are labelled in pull requests and approved by a senior engineer before merge.
- Clients can restrict or forbid AI tools for their engagement; the restriction is written into the SOW.
- No personal use of client systems; no copying client data to personal devices or storage.
Engineer code of conduct
- Protect client confidentiality during and after every assignment.
- Report security concerns, mistakes and conflicts of interest immediately.
- Keep availability and timesheets accurate.
- Treat client teams and colleagues with respect, in every language and channel.
Frequently asked questions
Yes, once they are issued: the full policy set is in preparation. Request it from the document register in the Trust Center and we share it under NDA as soon as it is ready, before any contract. If your legal team requires its own NDA, send it with the request and we respond within 2 working days.
Yes, under a written AI-usage policy. Engineers use only approved tools in zero-retention or enterprise modes, never put client code into consumer tools, and label AI-assisted changes in pull requests. A senior engineer approves every merge, and you can restrict AI tools for your engagement in the SOW.
At least once a year, and also after any significant incident or relevant regulatory change, such as an update to NCA ECC or PDPL guidance. The version and last review date for each policy are shown on this page, and material changes are posted on the updates feed.
Yes. During onboarding, engineers complete your security policies and acknowledge each one by name and date before production access. Your policies apply alongside ours; where they're stricter, yours win for your engagement. Upload them once on the onboarding page and every new engineer on your account completes them automatically.
We investigate immediately, can freeze the engineer's access within minutes, and tell you what happened. Depending on severity, the engineer is removed from your engagement and replaced under the Remote Pro Ai Guarantee: a replacement starts within 4 working days; the full handover completes in under 14 days.