Skip to content
Scalexa On-Demand

Scalexa On-Demand — Security & data note

1. Access: least privilege, always.

  • We ask for the minimum access each request needs, and say what it is before we start. Typical access: a GitHub deploy key or repo collaborator on one repo, a scoped IAM role (assumed by us, with an external ID), or a read-only database user.
  • We never ask for root, owner or admin credentials, and never for your personal logins.
  • Secrets travel only through your own secrets manager or a one-time secret link. They never go on the request board, in email, or in chat.
  • Access is logged on your board under the request. We remove it, and ask you to rotate anything shared, within 1 business day of cancelling.

2. Who touches your code.

  • Scalexa engineers and vetted contractors. Before anyone works on your requests, they have signed confidentiality, IP-assignment and data-processing terms with Fluxscale Limited.
  • Only UK- or EEA-based engineers handle your data, unless an approved UK international data transfer agreement (IDTA) is in place for that person.
  • Every deliverable is reviewed and signed off by a Scalexa engineer before it reaches you, including anything drafted with AI.
  • We'll sign a mutual NDA before you share anything. Just ask.

3. AI use.

  • We use AI coding and analysis tools on business or enterprise plans that don't train on customer data ✔.
  • We don't put secrets, credentials or personal data into prompts.
  • All AI-assisted code is read, tested and reviewed by a person before delivery. You receive it as a normal pull request or document you can inspect.
  • If you'd rather we don't use AI on a particular request, mark it "No AI" and we'll do it by hand. It may take longer.

4. Your data.

  • We work in your environment or on a branch wherever possible, and don't copy production data to our machines.
  • If a sample is needed, we ask for anonymised or synthetic data. Anything we do hold is deleted when the request closes.

5. IP.

  • Everything we deliver is yours once delivered. We keep only generic know-how.

6. What this service is not.

  • It isn't a managed security service, an on-call or incident response service, or a formal penetration test or certification audit. For those, ask about a retainer or a fixed-scope engagement.

7. Hours and contact.

  • We work UK business days, Mon–Fri 09:00–17:30 UK.
  • Security questions: hello-ai@scalexa.com.

Data protection paperwork: where we process personal data for you, our data processing addendum applies (available on request). Our sub-processors, with where they are and how transfers are covered, are available on request.

Scalexa is a trading name of Fluxscale Limited (England & Wales, 14247405).