How we handle your code

Why this page exists

When software you already run comes to us, the first step is an assessment: a bounded, read-only look at what the code actually does. That means giving us your source code, and the person who approves that is entitled to know, before they do, who will see it, where it goes, what is done with it, and when it comes back. This page is that answer.

What we ask for

• Read-only access to the repository — a read-only collaborator seat or a deploy key on the repositories in scope. An exported archive works too. We never ask for write access for an assessment.
• The schema and configuration that the code depends on, with secrets removed. We do not need production credentials, production data, or access to running systems.
• One person who can rule. Recovery turns up behaviour nobody wrote down, and someone on your side has to say whether each case is intended or an accident. That is a few hours of their time, spread across the assessment.

A confidentiality agreement is signed before access is granted. If you have your own form, we will work from it.

Who sees it

VerticalHorizon is a practice with one principal, Edward Cruz, and no staff. He is the only person who reads your code. Nothing is subcontracted, and nothing is shared with a third party for their own use.

Where it goes

Your code is cloned onto equipment we control in Tucson, Arizona, and stays there for the duration of the assessment. It is not uploaded to a hosted repository of ours, a shared drive, or a ticketing system.

Parts of it are read by AI models. The recovery tooling sends source files to Anthropic’s API to recover what the code does. Anthropic’s commercial API terms do not permit it to train models on customer data sent through the API, and it is processed in the United States. If your policy excludes third-party model providers, say so before the assessment begins: the inventory stage is deterministic and runs entirely on our equipment, and we will tell you plainly what the rest of the assessment can and cannot do without the models.

What is done with it

The code is read once. From it we produce a small set of structured documents: an inventory of routes, screens, schema, modules and jobs; the matrix of what the system does, recovered area by area; a specification written from that matrix; and a register of where the code and the intended behaviour disagree. Everything after the assessment works from those documents, not from the codebase. They are yours.

During an assessment nothing is changed. If we are later engaged to remediate or re-implement, the first thing written is a set of tests that pin today’s behaviour, quirks included, so that nothing a user or another system depends on changes silently. Until you rule otherwise, the code is the truth: a bug becomes a requirement unless you say it is an accident.

When it comes back

At the end of the assessment the clone and every working copy are deleted from our equipment, and we confirm that to you in writing. If the engagement continues into remediation or re-implementation, the code stays only as long as that work does, under the same terms. The documents we produced are delivered to you and we keep a copy only if the agreement says so.

What we never do

• Use your code, or anything learned from it, for another client or for our own products.
• Publish any of it, in a case study or anywhere else, without your written agreement to a specific, anonymised text.
• Keep a copy after the engagement ends unless the agreement says so.
• Ask for more access than the work in front of us needs.

Questions

Ask before you grant access, not after: hello@verticalhorizon.ai. If your security team has a questionnaire, send it; answering it is part of the assessment, not an extra.