Enterprise Pack.
Everything your CTO, legal counsel, or procurement committee needs to review before signing a contract: architecture diagrams, security questionnaire answers, subprocessor disclosures, and data ownership terms.
100% Client Ownership & Zero Vendor Lock-in
How I structure every engagement to ensure you are never held hostage
All code, databases, and APIs are deployed directly inside your AWS, GCP, or Supabase organization. You hold the root keys; I work via scoped IAM credentials.
Written in standard PostgreSQL, TypeScript, and Next.js. No proprietary runtime, no closed-source SDKs, and no custom dependencies that lock you to me.
Full documentation, schema migration scripts, seed files, and automated test suites are committed to your private GitHub repository on final signoff.
Security Questionnaire Standard Responses
Direct, transparent answers to typical vendor security and privacy assessment forms.
All databases and application instances are hosted directly inside the client-owned cloud account (AWS, Google Cloud, or Supabase). No customer operational data ever resides on multi-tenant SaaS servers owned by Arslan.
All network traffic enforces TLS 1.3 encryption in transit with strict HSTS headers. Storage volumes, database disks, and backups are encrypted at rest using industry-standard AES-256 keys.
PostgreSQL Row-Level Security (RLS) and Role-Based Access Control (RBAC) are enforced at the database layer. Database superuser keys are never bundled into client applications; web clients query via strictly scoped roles.
Point-in-Time Recovery (PITR) is configured with continuous Write-Ahead Log (WAL) archiving, enabling recovery to any second. Full restoration drills are executed quarterly to verify balance integrity.
Never. AI agents use enterprise API tiers (Google Cloud Vertex AI / Anthropic Enterprise) with explicit zero-retention contracts. Client prompts and documents are never used for model training or retained in shared caches.
Critical operational outages (P1) trigger direct developer response within 4 hours. Security vulnerabilities are patched within 24 hours of notification with post-mortem documentation.
Approved Subprocessor & Infrastructure List
Third-party enterprise providers leveraged for compute, storage, and zero-retention AI inference
| Provider | Operational Role | Data Center Region | Security Compliance |
|---|---|---|---|
| Google Cloud Platform (GCP) | Server compute, Vertex AI model API, Cloud SQL (optional) | United States / European Union (Client-Selected Region) | SOC 2 Type II, ISO 27001, HIPAA, GDPR |
| Anthropic PBC | LLM reasoning API (Claude 3.5 Sonnet / Haiku) | United States (Zero data retention enterprise tier) | SOC 2 Type II, HIPAA, GDPR |
| Supabase / AWS RDS | Managed PostgreSQL, authentication, and WAL archiving | Client-selected AWS region (us-east-1, eu-west-1, etc.) | SOC 2 Type II, ISO 27001, GDPR |
| Vercel Inc. | Edge application delivery and serverless compute | Global Edge Network (Encrypted payload proxy) | SOC 2 Type II, ISO 27001, GDPR |
P1 & P2 Incident Triage
• Severity 1 (Outage): < 4 hours response SLA.
• Severity 2 (Degraded): < 24 hours response SLA.
• Direct engineer escalation with post-incident Root Cause Analysis (RCA).
Point-in-Time Recovery
• Continuous Write-Ahead Log (WAL) archiving.
• RPO (Recovery Point Objective): < 5 minutes.
• RTO (Recovery Time Objective): < 2 hours to fresh sandbox.
• Quarterly restore drill with automated checksum verification.
Contractual Terms
Ready to begin procurement review or request a DPA?
Book a 20-minute discovery call to discuss your organization's security requirements, compliance checklists, or custom SOW milestones.