Security and vendor posture

We don't touch PHI or client records during scoping or the build unless a BAA is signed first. ThynkQ carries no E&O insurance today. We will bind E&O coverage and issue a certificate, and sign a BAA, before any PHI work starts. If we cannot, we decline the work. If your intake needs a certificate before scoping, say so in the first email.

Any subprocessor that would see PHI must also be BAA-covered, or is excluded from that engagement.

5 fixed-scope starting points: 4 build lanes (Build Readiness Audit, Rescue Sprint, Launch Build, Product Build) and one specialist review (MCP Risk Review). Full scope, pricing, and comparison live on Pricing.

If you are running vendor intake on ThynkQ, this page answers the questions on your form. It includes the answers that are no. Nothing here is aspirational and nothing here is a certification we do not hold.

ThynkQ is a senior engineering studio operated by Abanoub Rodolf Boctor in New York, NY. ThynkQ is not a separately incorporated entity. Agreements are currently signed personally. If your procurement process requires a company rather than an individual as the counterparty, we cannot meet that today. We plan to form an entity, and bind E&O insurance, after our next signed deal. That is a plan, not a promise to any one buyer.

For the full delivery, proof, and ownership record beyond vendor intake, see the full due-diligence pack.

If any of those is a hard gate in your process, you have your answer now. Ask before scoping and we will tell you plainly whether it can be met. What is settled: under our Terms, total liability on any engagement is capped at the fees you paid for that engagement, and disputes are governed by the law of the State of New York.

The default is least access. We ask for what the build needs and nothing adjacent to it.

Some engagements genuinely need production access. A live incident is the usual reason. When that happens it gets written into the statement of work: what is accessed, by whom, for how long, and how access is revoked at handoff. It does not happen on a verbal ok.

Credentials. Send them through your secret manager, your vault, or a one-time link. Not email, not chat. If you send a long-lived key we will ask you to rotate it and scope it down.

Handoff. At the end of an engagement you revoke our access. Repos, cloud accounts, third-party dashboards. Ask us to confirm what we still hold and we will list it.

Your project runs on infrastructure in your accounts, under your billing, with your name on it. We build inside your cloud and your repos, not on a ThynkQ platform you would have to migrate off later.

The precedent is PowerLiens. We replaced a paid third-party mapping dependency with map infrastructure the client owns and runs. That work is documented. The subprocessor list below is what thynkq.com itself runs on. It is not your delivery path.

ThynkQ uses AI models in delivery. The vendors are Anthropic (Claude), DeepSeek, and local models running on ThynkQ's own hardware.

Context sent to a hosted model leaves our machines and goes to that vendor. Local models run on our own hardware and send nothing to a vendor. A client can restrict their engagement to named vendors, or to local models only, in the statement of work. Where the statement of work names fewer vendors, the others are not used on your code or data.

Protected health information follows the regulated-data rule above: no model vendor sees PHI unless a BAA covers it. This section is about delivery work on your project. The table below is about thynkq.com.

The entries below are the services thynkq.com itself uses today. They describe thynkq.com, not a client delivery environment.

Google OAuth is available only when configured, and it can sign in the owner or an active client portal account. It is not set for ordinary site visitors. Fonts are self-hosted at build time, so no font CDN sees your requests. Full cookie and retention detail is in the Privacy Policy.

Mutual NDA. Standard and available on request. We will sign one before project details are discussed, not after. Email and it comes back within two business days. If you have your own paper, send it and we will review yours rather than push ours.

Confidentiality. Codebases, roadmaps, and business context stay private. We do not name clients or describe engagements without written consent. 3 delivery relationships back the public claims on this site: a named client engagement, a co-founded product, and one confidential client engagement under NDA. The NDA engagement is not named anywhere on this site, including in the places where naming it would help us sell.

IP assignment. All custom code and deliverables transfer to you on receipt of full payment. You own the product outright, including the right to modify it, hand it to another vendor, or sell it. The precedent is PowerLiens: they own the map infrastructure we built for them, and this studio makes no ownership claim over it.

What we keep. Generic techniques and non-client-specific tooling, the same way any engineer carries their craft between jobs. Nothing proprietary to you, no derived data, no reuse of your code in another engagement.

The deposit term is real and worth stating without softening. The deposit is fully refundable if you cancel before kickoff begins. Once kickoff begins, the deposit is non-refundable. No work starts before the deposit clears.

Here is what actually limits your exposure.

After kickoff, a fixed-scope build has no published client termination or wind-down clause today. If your process needs one, raise it during contracting and get it into the statement of work. The published Terms give a client two cancellation paths. Before kickoff, a cancelled build gets its deposit back in full. On the Engineering Retainer, you can cancel after the 3-month initial minimum with 14 days notice, with no refunds for the current billing period. After kickoff, the one termination clause in them that reaches a fixed-scope build is ours: we can end an engagement that breaks the acceptable use policy, with a pro-rated refund for services not yet rendered.

3 delivery relationships back the claims on this site. The same set is on the Proof ledger: a named client engagement, a co-founded product, and one confidential client engagement under NDA.

ProTeach is a co-founded product, not a client engagement. It was co-founded and built, not delivered for a paying client. Its public surface is on the Work page, and its numbers are sourced on the provenance audit.

The confidential engagement is under NDA. We cannot name the client, describe the engagement, or publish metrics from it. Numbers that once appeared here were removed because they could not be independently verified.

No testimonials. There are none on this site, and that is deliberate. We do not publish praise we cannot attribute to a named person who agreed to it.

Read the code instead. mcp-scan is our MCP server security scanner, MIT licensed, published on npm with source at github.com/Abanoub-Rodolf/mcp-scan. Judge the engineering directly rather than taking our word for it.

Send your vendor questionnaire to rodolf@thynkq.com. We answer it as written, in writing, so you have something to attach to your intake record. Where the answer is no, it says no. We do not leave a field blank hoping it slides through.

If you need an NDA signed before you can share the questionnaire, say so in the first email and we will send one back before you send anything else.

To report a vulnerability in thynkq.com, email the same address with details and a way to reproduce it. We will confirm receipt and tell you what we did about it.

This page changes when the facts change, and the date at the top moves with it. If we ever obtain a certification listed above as absent, it will appear here with the report available on request. Until then, treat the absence as accurate.