Security & trust
Your work stays private. Everything we make is yours.
We sign an NDA before you share anything private, hand over every agreed file once invoices are paid, and never let an AI agent publish on its own: a person approves every change.
What we commit to
The short version for your procurement team.
NDA before anything private
We send our mutual NDA or sign yours before you share decks, roadmaps, unreleased products or internal tools.
You own the work
The contract assigns the IP to you outright on the final payment: Figma files, brand assets, source files, code and docs.
Your accounts, no lock-in
We can work in your Figma, Slack, Notion, GitHub, Webflow or Framer from day one, so you control who has access.
Private until you launch
Unreleased products, fundraising materials and roadmaps stay private, and we ask before showing your work publicly.
Licences up front
Paid fonts, tools, templates and libraries are named up front, with what you need to license yourself.
Changes you can review
Coded work lives in a repo you own, and every change arrives as a pull request with a preview link.
Scoped AI access
Agents we set up run on your accounts. Reading, drafting, publishing and approving are separate rights, and every action is logged.
Built to WCAG 2.2 AA
We build to WCAG 2.2 AA. Every page is checked for accessibility, contrast, broken links and performance, then a person signs it off.
Same terms for everyone
Anyone we contract work to signs the same NDA and IP terms we sign with you.
2FA on every account
Two-factor authentication is on for every account we use for work.
Access removed fast
We remove access almost immediately when a project ends, a contractor stops or someone leaves.
Breach notice in 48 hours
If a security incident affects your data, we tell you within 48 hours.
Certified and regulated teams
Not certified ourselves. We work to your vendor rules.
We’re not SOC 2 or ISO 27001 certified ourselves. We regularly work with companies that are, and we follow their vendor requirements.
Your accounts, your controls
We work inside your tools under your SSO, 2FA and access rules.
Least access, removed at the end
Only the access the work needs, revoked as soon as the work ends.
NDA and DPA
We sign yours, or provide ours. A DPA based on GDPR Article 28 is available on request.
Security questionnaires
We fill in yours, for example SIG Lite, CAIQ or your own, and share our security overview.
AI under your rules
Agents run on your accounts, every action is logged, and a person approves every change.
GDPR and UK GDPR
We’re an EU-based team with clients in the UK, so both apply to the personal data we handle for you.
European Accessibility Act
Since June 2025, many consumer websites and apps in the EU must be accessible. We build to WCAG 2.2 AA and check contrast, keyboard use and screen readers.
Security, fintech and compliance teams our team has worked with.
Send your security questionnaire with the request and we’ll answer it question by question.
How we use AI safely
Agents draft. People approve what ships.
We use AI agents across research, design, code and QA, inside your design system and rules we write down. Agents we set up for you get only the access the agreed work needs, and a person approves every change before it goes live.
Our AI processAI does
- Works from the brief, your design system and the rules we write down
- Drafts pages, code and checks, each change with a preview
- Connects only where agreed: read, draft, publish and approve are separate rights
- Logs every action it takes
People do
- Decide what an agent may read, change and publish
- Review every change and fix what the agent gets wrong
- Approve before anything goes live
- Train your team to review and approve
What you own
Paid for means handed over.
Once invoices are paid, the agreed deliverables belong to you. Your files, no lock-in.
Figma files and design systems
Every file, component and variable, in your workspace or handed over to it.
Brand assets and source files
Logos, colour, type and the working files behind them.
Code and components
In a repo you own, each change made as a reviewed pull request.
Documentation
Docs for your team and for the AI agents that work on your site.
AI workflows
The workflows we build run on your accounts and stay yours, retainer or not.
Licensed separately
Paid fonts, tools, templates, libraries and external assets keep their own licences. We say up front what’s included and what you need to license.
Tools and subprocessors
Where your files and messages live.
The services we use on client work. Your data is stored with each provider, in their infrastructure, and we can use your accounts instead of ours for any of them.
| Tool | What we use it for | What it holds |
|---|---|---|
| Figma | Design files, prototypes and design systems | Designs and the material you share for them |
| Slack | A shared channel for day-to-day work | Messages, files and links shared in the channel |
| Notion | Project docs and client portals | Briefs, plans and project notes |
| Loom | Recorded walkthroughs of the work | Screen recordings of work in progress |
| GitHub | Code, pull requests and previews | Source code for the sites and products we build |
| Webflow and Framer | Building and publishing websites | Site content and CMS entries |
| Claude and Claude Code | Research, writing, code and QA | What we give it for the task at hand |
| Cal.com | Booking calls | Your name, email and what you write when booking |
| Stripe | Invoices and payments | Billing details |
Security question or concern? Email hello@designme.agency.
FAQ
Questions procurement teams ask us
Need our security pack?
Send your security questionnaire and we’ll answer it directly.
Do you sign NDAs?
Yes. We have our own mutual NDA we can send, and we can always sign yours instead. We sign it before reviewing private materials, unreleased products, decks, internal tools, or roadmap details.
Do people you contract work to sign the same terms?
Yes. Anyone we contract work to signs the same NDA and IP terms, so everything they make for you is covered the same way.
Will you show our work in your portfolio?
Only with your permission. We ask before showing any client work publicly, in our portfolio or on social.
Do we own everything you design and build?
Yes. The contract assigns the IP to you outright on the final payment, so once invoices are paid the agreed deliverables belong to you.
That can include Figma files, brand assets, source files, code, components, documentation, and other agreed project materials.
If third-party tools, fonts, templates, or licenses are involved, we’ll make that clear.
Can you work inside our tools and accounts?
Yes. We can work inside your Slack, Figma, Notion, Linear, GitHub, Framer, Webflow or whatever your team already uses, from day one. Your accounts, your access rules.
How do you handle access to our accounts?
Two-factor authentication is on for every account we use for work. We remove access almost immediately when a project ends, when we stop working with a contractor, or when someone leaves.
Where is our data stored?
With each tool’s provider, in their infrastructure: Figma, Slack, Notion, GitHub and the others in the table above. If you’d rather keep it in your own accounts, we work in yours.
What happens to our files after the project?
You get every agreed file at handover. We keep our project files as an archive of past work, and we delete or return any personal data from your project on request.
Will you tell us about a security incident?
Yes. If an incident affects your data, we tell you within 48 hours, so you can meet your own GDPR duty to report to the authority within 72.
Do you use AI on client work?
Yes, for the legwork. AI drafts options, code and checks. Senior designers and developers choose, refine and finish what you see, and nothing ships until a person has approved it.
Can an AI agent publish to our live website?
Only through the approval step we set up. The agent prepares the change and a preview; someone on your team approves it, and that approval publishes it.
Where does an agent run, and what can it access?
On your accounts and infrastructure, with access limited to the agreed workflows. Reading, drafting, publishing and approving are separate permissions, and every action is logged.
Does GDPR apply to DesignMe?
Yes. DesignMe is headquartered in Gdańsk, Poland, so EU data protection law applies to how we handle personal data, and our terms are governed by Polish law.
What accessibility standard do you build to?
WCAG 2.2 AA. We check contrast, keyboard use, screen readers and structure before launch, which also covers what the European Accessibility Act expects.
Are you SOC 2 or ISO 27001 certified?
No. We’re a senior design and development team, not a software platform, and we’re not SOC 2 or ISO 27001 certified ourselves. We regularly work with companies that are, and we follow their vendor requirements. Send us your security questionnaire and we’ll answer it question by question.
Can you work within our SOC 2 or ISO 27001 controls?
Yes. We work inside your tools under your SSO, 2FA and access rules, take only the access the work needs, and have it removed when the work ends. We fill in your vendor security questionnaire (for example SIG Lite, CAIQ or your own) and share our security overview.
Do you sign DPAs?
Yes. We sign your NDA and DPA, or provide ours. Our DPA is based on GDPR Article 28 and is available on request.
You've reached the end, so now…
Tell us what you’re building.
We’ll help you map the right scope, team, timeline, and next steps.
Book a call