Security,from the first call.
Clients trust us with their code, their data and their ideas. These are the practices that protect them, from the first conversation to a system running in production.
In every engagement.
Confidentiality and ownership are settled before work begins, and security has its own place in our engineering lifecycle.
Protected before we talk detail
NDA and IP-assignment terms are signed before any technical exchange. Intellectual Property Counsel is part of our team from the outset.
Your systems stay yours
Infrastructure is built as code in your own cloud account, and the code we write is assigned to you. Nothing you depend on lives only with us.
Access only where it is needed
Engineers receive the minimum access a task requires, for as long as it requires it. Access to production data is agreed with you in advance and removed when the work ends.
Security is a stage, not an afterthought
Every engagement includes a Security & Governance stage that ends in a written security review, access controls, and data-handling and compliance documentation.
Reviewed before it ships
Every change is code-reviewed by a second engineer, and builds check dependencies and secrets before anything reaches production.
Your data does not train other models
Client data is never used to train third-party AI models without written permission. Model providers are chosen and configured with that in mind.
For AI systems.
AI brings its own risks. We test for them before launch and keep watching after.
Evaluation before release
AI systems are measured against thresholds agreed in advance, including accuracy, groundedness and safety, and are released only when they meet them.
Guardrails and abuse testing
Inputs and outputs are filtered, and systems are tested against prompt injection and data leakage before launch.
Watched in production
Monitoring covers model drift, cost and unusual behaviour, with alerts to the team that owns the system.
Standards we are working toward
ISO/IEC 27001 for information security and ISO/IEC 42001 for AI management systems are both planned.
On this website.
The same care applies to the site you are reading.
Encrypted everywhere
The site is served only over HTTPS, with HSTS so browsers never fall back to an unencrypted connection.
Locked-down pages
A strict Content Security Policy and modern security headers block third-party scripts, framing and content sniffing.
No cookies, no trackers
The site sets no cookies and runs no analytics or advertising trackers.
A protected contact form
Spam checks, rate limits and validation guard the form. CVs are checked to be genuine PDF or Word files, emailed to our recruitment team and not stored on the site.
Report a vulnerability.
If you believe you have found a security issue in this website or in a system we built, please email ceosahan@ceylonlabsai.com with “Security report” in the subject. We will acknowledge it within three working days and keep you informed until it is fixed. Please do not access data that is not yours, and give us reasonable time before disclosing it publicly.
Tell us about the problem. A senior technical lead replies, not a sales funnel.