Information securityInformation security

Position

Security is designed in from the first architecture decision, not added after delivery. That principle is written into how we work across Polaris, Orbit, Terra, Lumen and Vector, and it applies to metateam.dev as well as to client systems.

Scope

This page describes our public security posture for the corporate site and for how we approach client engagements. Detailed controls for a specific engagement are set out in the contract, statement of work and any security schedule agreed with you. We do not publish internal runbooks, network maps or vulnerability detail here.

Website and corporate systems

metateam.dev is served as a static site from Cloudflare Workers with prerendered pages. Contact submissions are handled by a constrained API route and delivered by email (and optional storage) using credentials held as secrets, not in the repository.

Access to deployment, DNS and secret stores is limited to people who need it for their role. We keep dependencies and the deployment pipeline under version control and review.

Client engagements

For client work we agree environment ownership, identity, network boundaries, logging and data residency up front. We prefer systems that run in environments you control, on the cloud footprint you choose. Models, data pipelines and applications are documented so your teams can operate them without us.

• Identity and least-privilege access as defaults
• Segmentation between environments and sensitive data paths
• Auditability of changes that affect production decisions
• Reversible rollout steps for migrations and model releases

Data handling

We collect only what the contact form and operational logs require for this site. Client data stays in the agreed environments. We do not use client production data to train public models or to market MetaTeam.

Vulnerability reports

If you believe you have found a security issue in metateam.dev or in a MetaTeam-operated system that is in scope for responsible disclosure, write to security@metateam.dev with enough detail for us to reproduce the issue. Do not access data that is not yours, and do not degrade availability while testing.

We acknowledge reports sent to that address and aim to provide an initial assessment within five working days.

Contact

Security: security@metateam.dev. Privacy: privacy@metateam.dev. General: info@metateam.dev.