Rachuri Labs LLC: Security & AI-Use Policy

A small Texas studio building Java/Spring, integration and AI-feature work. Version 1.0 · Effective November 7, 2026

Status, stated plainly: Rachuri Labs is not certified (no SOC 2, no ISO 27001). We follow the practices below and are happy to complete your security questionnaire. If your policy requires something stricter, tell us before the SOW is signed.

This page describes our standard practices. If your signed MSA, SOW or data-processing agreement says something different, the signed agreement controls.

1. Where code lives

• Studio mode (our default): we build in a private repository in the LLC’s own account and deliver tested code to your repository as pull requests. The working repository is deleted at handover.
• Embedded mode: we work only in your Git organisation and tools, under accounts you create or approve, when code or data can’t leave your systems.
• You own the deliverables as set out in the SOW/MSA. We keep no copy of your code after the engagement ends (section 9), except what the contract requires.

2. Access control

• Least privilege: the minimum role, on the minimum repositories and environments, for the minimum time.
• MFA on every account that touches client work (email, Git, cloud, password manager, AI tools).
• Per-client credentials: separate accounts, keys and tokens for each client; nothing shared between clients.
• Revocation: at the end of the engagement, or when a person leaves the work, we ask you to remove our access, and we remove ours, on the same day. We confirm in writing.

3. Secrets

• Secrets (API keys, passwords, tokens, certificates) are kept in a password manager or your secret store, never in source code, tickets, chat or AI prompts.
• Local config files holding secrets are git-ignored; repositories are scanned for secret-shaped strings before delivery.
• We prefer short-lived, scoped credentials that you issue and can revoke. Any secret exposed by mistake is treated as compromised and rotated (section 7).

4. Client data

• Sample or masked data first. We build and test on synthetic, sample or masked data wherever possible.
• No production data unless the SOW or a data-processing agreement expressly allows it, naming who may access it, where, and for how long.
• No client data goes into AI tools that train on inputs. Client code and data are used only in AI tools on business/commercial plans whose terms say inputs are not used for model training (section 5).
• We collect only what the work needs and do not use client data for any other purpose or client.

5. AI use: “AI-assisted, engineer-reviewed”

• We use AI coding assistants to speed up design, code, tests and documentation. By default that’s Anthropic’s Claude, on the LLC’s own accounts, never a personal one. On your project we can use your approved tools instead, and AI features we build for you run on the AI platform you choose. We say so up front, in proposals and in the SOW.
• Training on inputs: client code and data go only into AI services under business terms that bar the vendor from training on customer content (for Anthropic: its Commercial Terms, which cover the Team, Enterprise and API offerings). Our individual-plan AI accounts are not used for client material.
• If you need a different setup (a different AI vendor, a region, or no AI at all on your code), say so and we will price and document it. We do not hide AI use, and we do not enter your code into AI tools you have not approved.
• AI output is treated as untrusted draft code: no change is accepted because an AI wrote it.

6. Human review and testing

• Every change is reviewed by a named engineer before it is merged. Nothing goes to your repository or environment unreviewed.
• Tests accompany the code: unit and integration tests, plus acceptance checks tied to the SOW’s acceptance criteria. Tests pass before delivery.
• Dependency and secret scans are run before each milestone; known high-severity findings are fixed or disclosed.
• Deliverables come with a short proof sheet (what was tested, how, and the results).

7. Incident notice

• If we find or suspect a security incident affecting your code, data or credentials, we notify your named contact without undue delay, and no later than 72 hours after we become aware, sooner where the law or your contract requires. Where we hold personal information on your behalf, Texas law requires us to tell you immediately after we discover a breach.
• The notice says what happened, what is affected, what we have done (including rotating credentials), and what we need from you. We then keep you updated until it is closed.

8. People: contractors, NDAs and IP

• Today the team is our lead engineer plus AI agents. Later we may add vetted contractors, possibly outside the US.
• Every contractor signs a confidentiality agreement and a written IP assignment before seeing any client material, and gets only the access in section 2.
• We add a contractor to your project only with your written consent, after telling you who they are and where they work. If your project needs US-only staffing or data location, say so at the start and we will tell you before the SOW whether we can meet it.

9. Deletion at the end

• Within 30 days of the engagement ending (or sooner if the SOW says), we delete your code, data and credentials from systems and AI-tool histories we control, and confirm in writing. Copies held in our providers’ routine backups or retention are deleted on those providers’ schedules, and we don’t restore or use them. We keep no backups of client material of our own beyond the engagement.
• We keep only what law or contract requires (for example invoices and the signed agreement).

10. Location and time zone

• Rachuri Labs is a Texas LLC. The team currently works from the United States, on US Central Time.
• From around mid-2027 some or all work may be done from India (IST, UTC+5:30). We will tell you in writing before any change, keep overlap hours with your team as agreed in the SOW, and apply the same controls everywhere. If your contract restricts where work or data may be handled, we will follow it or tell you we cannot.

---

Contact: Rachuri Labs LLC, hello@rachurilabs.com, (945) 677-4321. Security questionnaires and data-handling questions are welcome at any stage.