Security summary

Dino Sloth selects people appropriate to the work. Everyone who will work on an engagement is identified to the client by name and role, and covered by the same confidentiality, access and deletion terms, before access is granted. No unnamed contractors.

Devices used for client work are dedicated, full-disk encrypted (AES-256), unshared and set to lock automatically. No client material on phones or tablets. No consumer cloud sync; backups exclude client directories. Hardware keys (FIDO2) on every account that touches client access.

Source, assets and builds do not leave the client environment. Repository access, where granted, is read-only and scoped to the relevant depot paths, with no submit or admin rights. Any local sync needed for symbolication stays on the encrypted machine, is excluded from backups and is removed at readout. Most reviews need a playable build and permission to capture — not source.

No client source, assets, captures, documents or notes are placed into public or consumer AI services. Any AI tooling used on client material is one the client has approved in writing, under the client's own terms.

The working machine is in Thailand. Where a client requires residency in a specific region, work runs entirely inside the client's VPN, VDI or managed workstation — so no client material rests or transits outside the client's own jurisdiction at any point.

At readout: credentials and tokens destroyed; client asked to revoke accounts the same day. 30 days after delivery: traces, captures, notes and drafts deleted, confirmed in writing. 12 months: final report only, so a copy can be reissued; deleted earlier on request. A shorter schedule can be written into the SOW.