Vendor posture
Security and vendor posture
Last updated: July 27, 2026
What this page is
If you are running vendor intake on ThynkQ, this page answers the questions on your form. It includes the answers that are no. Nothing here is aspirational and nothing here is a certification we do not hold.
ThynkQ is a senior engineering studio operated by Abanoub Rodolf Boctor in New York, NY. It is not a separately incorporated entity. Agreements are signed personally. If your process requires a registered counterparty, that is a real blocker and you should know it before the second call, not after.
What we do not have
- No SOC 2 report, Type I or Type II.
- No ISO 27001 certificate.
- No HIPAA attestation, and no Business Associate Agreement in place today.
- No PCI attestation. Card data goes to Stripe directly and never touches our systems.
- No insurance claim is made on this page. If your intake requires a certificate of insurance, raise it during scoping so it gets settled in writing rather than assumed.
- No penetration test report on file for thynkq.com.
If any of those is a hard gate in your process, you have your answer now. Ask before scoping and we will tell you plainly whether it can be met. What is settled: under our Terms, total liability on any engagement is capped at the fees you paid for that engagement, and disputes are governed by the law of the State of New York.
What we touch during an engagement
The default is least access. We ask for what the build needs and nothing adjacent to it.
We ask for
- Repository access, scoped to the repos in the engagement, on permissions you grant and can revoke.
- Staging and development environments.
- Credentials for third-party services in scope, delivered through your secret manager or vault.
- Product, architecture, and API documentation.
We do not ask for
- Production customer records.
- Protected health information, payment card data, or government IDs.
- Standing production database access.
- Employee HR or payroll systems.
Some engagements genuinely need production access. A live incident is the usual reason. When that happens it gets written into the statement of work: what is accessed, by whom, for how long, and how access is revoked at handoff. It does not happen on a verbal ok.
Credentials. Send them through your secret manager, your vault, or a one-time link. Not email, not chat. If you send a long-lived key we will ask you to rotate it and scope it down.
Handoff. At the end of an engagement you revoke our access. Repos, cloud accounts, third-party dashboards. Ask us to confirm what we still hold and we will list it.
Where your project runs
Your project runs on infrastructure in your accounts, under your billing, with your name on it. We build inside your cloud and your repos, not on a ThynkQ platform you would have to migrate off later.
The precedent is PowerLiens. We replaced a paid third-party mapping dependency with map infrastructure the client owns and runs. That work is documented. The subprocessor list below is what thynkq.com itself runs on. It is not your delivery path.
Subprocessors for thynkq.com
Every service below is verified against this repository: the dependency list, the runtime environment keys, and the content security policy allowlist. If a vendor is not here, it is not in the path.
| Service | Role | What reaches it |
|---|---|---|
| Vercel | Hosting, edge network, cookie-free analytics, and the key-value store holding site config. | Sees standard request logs, including IP addresses. |
| Neon | Serverless Postgres behind site features. | Application data only. Not a client delivery environment. |
| Resend | Transactional and newsletter email delivery. | Sees the address and body of anything we send you. |
| Stripe | Payments for digital products and paid sessions. | Card data goes to Stripe directly and never reaches our servers. |
| Cal.com | Scheduling for calls booked from /book. | The embed stays unloaded until you ask for it. |
| Groq | LLM inference for the assistant on this site. | Receives anonymous on-site behaviour signals when you use the AI panel. No account data. |
Admin sign-in for the owner dashboard uses Google OAuth. That covers one account and no visitor data. Fonts are self-hosted at build time, so no font CDN sees your requests. Full cookie and retention detail is in the Privacy Policy.
NDA, confidentiality, and IP
Mutual NDA. Standard and available on request. We will sign one before project details are discussed, not after. Email and it comes back the same day or the next. If you have your own paper, send it and we will review yours rather than push ours.
Confidentiality. Codebases, roadmaps, and business context stay private. We do not name clients or describe engagements without written consent. One of our two engagements is under NDA and is not named anywhere on this site, including in the places where naming it would help us sell.
IP assignment. All custom code and deliverables transfer to you on receipt of full payment. You own the product outright, including the right to modify it, hand it to another vendor, or sell it. The precedent is PowerLiens: they own the map infrastructure we built for them, and this studio makes no ownership claim over it.
What we keep. Generic techniques and non-client-specific tooling, the same way any engineer carries their craft between jobs. Nothing proprietary to you, no derived data, no reuse of your code in another engagement.
Deposits, milestones, and stopping early
The deposit term is real and worth stating without softening. Deposits are non-refundable once kickoff begins. No work starts before the deposit clears. If you were hoping for a money-back guarantee, there is not one.
Here is what actually limits your exposure.
- The trigger is kickoff, not signature. The non-refundable clock starts when kickoff begins, not when the deposit clears. If you need the pre-kickoff position in writing, ask before signing and it goes in the agreement.
- Payment is milestone-gated. 50/50 on everything up to $19,000. Three milestones on $30,000+ engagements: 40/30/30. On a $30,000 build your exposure before the first delivered milestone is the 40% deposit, and it never grows past that. Each later payment is gated on delivered work you have seen.
- There is a cheaper way to test us. The $7,500 Build Readiness Audit runs one week, produces a written risk-ranked report, and the full fee is credited toward a build signed within 60 days. That is the low-commitment path if a $30,000 first engagement is too large a bet on a studio you have not worked with.
- Weekly proof, not a black box. Every week produces shipped changes and an acceptance checkpoint. If week two is wrong, you find out in week two.
We do not publish a termination or wind-down clause today. If your process needs one, raise it during contracting and get it into the statement of work. Do not assume the published Terms cover it, because they do not.
References
One named reference: PowerLiens.Full disclosure, because you would find it anyway: PowerLiens is also Rodolf's employer. Everyone there knows about ThynkQ and the arrangement is settled. Weigh the reference with that context. If you want to speak to someone there, ask and we will make the request.
The second engagement is under NDA. Healthcare AI covering intake, scheduling, and operations. We cannot name the client and we do not publish metrics from it. Numbers that once appeared here were removed because they could not be independently verified.
No testimonials. There are none on this site, and that is deliberate. We do not publish praise we cannot attribute to a named person who agreed to it.
Read the code instead. mcp-scan is our MCP server security scanner, MIT licensed, published on npm with source at gitlab.com/abanoub.rodolf/mcp-scan. Judge the engineering directly rather than taking our word for it.
Requesting a security review
Send your vendor questionnaire to rodolf@thynkq.com. We answer it as written, in writing, so you have something to attach to your intake record. Where the answer is no, it says no. We do not leave a field blank hoping it slides through.
If you need an NDA signed before you can share the questionnaire, say so in the first email and we will send one back before you send anything else.
To report a vulnerability in thynkq.com, email the same address with details and a way to reproduce it. We will confirm receipt and tell you what we did about it.
Changes to this page
This page changes when the facts change, and the date at the top moves with it. If we ever obtain a certification listed above as absent, it will appear here with the report available on request. Until then, treat the absence as accurate.