TukuToi / Policies and pages
Build policy
How your project gets built - hand-written or AI-assisted - and how audits are run. Which tools each uses, where your data goes, and what is never done.
You choose how your project is built. There are two modes. The mode is agreed before work starts and written into the project agreement. This page says, for each mode, which tools I use, where your code and data go, and what is excluded. The same rules cover security and code audits, including audits of code built with AI.
Whatever the mode: I do the work myself, and nothing reaches you that I have not read, tested and signed off. Every commit I deliver is signed with my GPG key. Code analysis runs on SonarQube (with SonarScanner) on my own server, so in every mode it stays on my machines.
“AI” on this page means generative models, usually run by a remote provider. Which providers I use, and under which terms, is set out in the AI policy.
At a glance
| Mode | Tools used | Where your data goes | Never |
|---|---|---|---|
| Hand-written | Editor, compiler, linters, self-hosted code analysis, test runners. AI features switched off; ordinary autocomplete is not AI and stays on. | My machines and your servers. Nowhere else. | AI tools of any kind, AI code review, AI transcription of our calls. |
| AI-assisted | The above, plus the AI providers named in the AI policy. | Code and test data reach the AI provider. Customer records do not. | Production data, passwords, keys or personal data sent to an AI provider. |
Hand-written
No AI tool touches your code or your data.
- Tools: Visual Studio Code with extensions that use no AI, the compiler or interpreter, version control, and the test runners and linters commonly used for the language at hand. For WordPress work: PHP_CodeSniffer with the WordPress Coding Standards. Code analysis: SonarQube with SonarScanner, on my own server.
- AI features off: AI completion, AI chat and AI review features in the editor and other tools are switched off for the project. Ordinary autocomplete is not AI and stays on.
- Your data: stays on my machines and your servers. It is not sent to any AI provider or other third-party service.
- Excluded: AI tools of any kind, AI code review, AI transcription or summaries of our calls and messages.
AI-assisted
AI tools help write and check code. A person stays in control of every result.
- Tools: everything from the hand-written mode, plus AI models from the providers named in the AI policy, under the terms set out there. No other AI provider is used.
- Review: every line an AI tool produces is read, tested and signed off by me before it is committed. No AI-generated code, content or data is delivered to you without that review.
- Your data: your code and test data are sent to the AI provider, only to get a response. Customer records are not.
- Excluded: production data, passwords, API keys, credentials and personal data are never sent to an AI provider.
Audits, including AI-built code
You bring code, made by a team, a freelancer, a tool or an AI. I audit it, tell you what I found, and fix what you want fixed.
- Tools: static analysis (SonarQube with SonarScanner, on my own server), test runners, and the dependency and licence scanners that fit the code at hand: which ones depends on its language and package manager.
- AI in the audit: only if you allow it. If you do, the AI-assisted rules above apply.
- Your data: your repository is checked out on an isolated machine used only for your project. When the project ends, it is deleted as described under “When the project ends” below.
- Excluded: nothing is deployed to your servers without your sign-off.
When the project ends
Everything that can be replicated - isolated machines, copies of your repositories, copies of your data - is deleted within 30 days of the end of the project.
Anything that cannot be replicated is deleted only after you confirm in writing that it is fine to delete, so nothing is lost by surprise.
Responsibility
Tukutoi LLC answers for the work it delivers, in every mode, within the limits of the project agreement and the Terms. What applies to AI providers is set out in the AI policy.
Changes to this policy
This policy only changes with notice. A change does not alter the mode agreed for a running project unless you agree to it in writing.