Security and procurement: what your reviewers need before they sign
One page for your procurement, security and legal reviewers: how we contract, who owns the code, how engineers are vetted and get access, how we answer questionnaires and how an engagement ends. It states only what is true today, and one section lists what we do not claim.
- Your company
- MSA, a SOW per engagement, NDA, DPA available
- DX Clouditive LLC
- Contractor agreement with IP assignment and NDA
- The engineers
The engineers are contractors of DX Clouditive LLC, not your employees
Contracting
How do we contract?
Under a master services agreement (MSA) with a statement of work (SOW) for each engagement, signed with DX Clouditive LLC, a US company. We sign an NDA before the first call if you ask, and a data processing agreement (DPA) is available. The engineers are dedicated, full-time contractors of DX Clouditive LLC, not your employees, and their contract carries an IP assignment and an NDA.
An engagement starts only when both parties have signed. The SOW fixes the price, scope, deliverables and duration, and what a fixed-price package delivers is written into it.
Documents
Which documents can you ask for?
Nothing on this page replaces the signed agreement. If a signed agreement conflicts with our Terms of Service, the signed agreement prevails for the engagement it covers.
NDA
We sign one before the first call if you ask.
MSA and SOW
The MSA is the master agreement with DX Clouditive LLC, and each engagement adds a SOW. Together they set the scope, fees, term, intellectual property, confidentiality, liability and every other commercial term.
DPA
A data processing agreement is available on request.
HIPAA BAA
We sign a HIPAA business associate agreement (BAA) when an engagement touches PHI. Ask for it on the first call, so that it is signed before an engineer has access to PHI.
Contractor agreement with each engineer
Between DX Clouditive LLC and the engineer. It carries an IP assignment and an NDA.
IP
Who owns the code and the intellectual property?
You do, from day 1. All code and intellectual property belong to you from the first day of the engagement. The engineers' contracts with us carry an IP assignment, and the engineers work in your own accounts and identities.
This page states our position. The signed MSA and SOW are what bind us: our Terms of Service say that work product we create for a client is governed by that agreement.
People
How are engineers selected and vetted?
Every engineer passes a background check before assignment. Before we present anyone to you, the engineer has had a technical interview built around a real exercise, an English interview and an interview with Mat Caniglia, our founder. Then you interview the engineer who will do the work.
Selection
- A technical interview built around a real exercise.
- An English interview, to check the engineer can work with you in English.
- An interview with Mat Caniglia, who interviews every engineer himself before we present them.
Background check
Every engineer passes one before assignment.
Your interview
You interview the engineer who will do the work. We present candidates within 1 week.
Access
How do engineers get access to your systems?
Through your own accounts and identities, with your single sign-on (SSO), multi-factor authentication (MFA) and least-privilege access. We revoke that access when the engagement ends.
- Sign-in goes through your SSO and your MFA.
- Each engineer gets least-privilege access: only what the work needs.
- Access is revoked when the engagement ends.
- We work in your business hours and offer no 24x7 on-call. We leave alerts and runbooks so your own on-call can resolve incidents.
Questionnaires
Do you answer security questionnaires and give references?
Yes. We complete your security questionnaire or vendor assessment on request, and we connect you with client references before you sign. We reply to every request within 1 business day.
Invoicing and exit
What are the invoicing, exit and transition terms?
Invoicing
In US dollars from DX Clouditive LLC, monthly in arrears, net 15, paid by international wire. We do not issue Mexican CFDI invoices.
Minimum term and notice
Staff augmentation has a 6-month minimum, billed per hour worked. After the minimum, 30 days' notice ends the engagement.
If an engineer leaves or does not fit
We present a replacement within 10 business days and cover the handover at no cost.
At exit
We revoke access, and the code and intellectual property are yours from day 1. Anything beyond this is written in the MSA and SOW you sign.
Trying first
Start with any 2-week fixed-price package before you commit to the 6-month minimum.
Our site's data
Where does the data from this website live?
DX Clouditive LLC is the controller of the personal data you send through dxclouditive.com. Microsoft 365 handles email and call booking, Google Cloud (Cloud Run and Firestore) stores contact and newsletter records, Cloudflare serves the site and runs the Turnstile check, and Meta's WhatsApp Business Platform delivers chat messages. We load no advertising or analytics trackers.
Processing can take place in the United States and in other countries where those providers operate. Retention is set per record type: for example 24 months for contact requests, 12 months for chat messages and up to 30 days for server logs.
The Privacy Policy covers this website and the emails we send from it. Data we handle for you during an engagement is governed by the agreement you sign and, where you need one, the DPA.
What we do not claim
What do we not claim?
We publish no SOC 2 or ISO 27001 certificate, no third-party audit report and no insurance statement, and this page claims none. If your policy requires one, tell us before you sign so that you know where we stand.
The engineering controls we build for clients, and the published work behind them, are on the compliance engineering pages: SOC 2, HIPAA, ISO 27001, PCI DSS, and GDPR and LGPD. Those pages describe engineering, not an audit.
- No certification or attestation, SOC 2, ISO 27001 or any other, is claimed for DX Clouditive LLC.
- No third-party audit report is published.
- No insurance cover is stated.
- No 24x7 on-call: we work in your business hours.
Frequently asked questions
Do you sign an NDA before the first call?
Yes, if you ask. We sign an NDA before the first call. We work under a master services agreement (MSA) with a statement of work (SOW) for each engagement.
Do you sign a data processing agreement?
A data processing agreement (DPA) is available on request. It sits beside the MSA and the SOW of the engagement.
Do you sign a HIPAA business associate agreement?
Yes, when an engagement touches PHI. Ask for the BAA on the first call, so that it is signed before an engineer has access to PHI. HIPAA has no certification and we claim none.
Who owns the code and the intellectual property?
You do, from day 1. The engineers' contracts with DX Clouditive LLC carry an IP assignment and an NDA, and the signed MSA and SOW are the binding text.
Do you run background checks on your engineers?
Yes. Every engineer passes a background check before assignment, after a technical interview with a real exercise, an English interview and an interview with Mat Caniglia.
How do your engineers get access to our systems?
Through your own accounts and identities, with your SSO, your MFA and least-privilege access. We revoke that access when the engagement ends.
Will you complete our security questionnaire?
Yes. We complete your security questionnaire or vendor assessment on request, and we connect you with client references before you sign.
Do you have SOC 2 or ISO 27001?
We claim neither. This site publishes no SOC 2 or ISO 27001 certificate, no third-party audit report and no insurance statement. What we show is how we contract, vet and give access, and the engineering controls in our published cases.
What happens if an engineer leaves?
We present a replacement within 10 business days and cover the handover at no cost. After the 6-month minimum, 30 days' notice ends the engagement.
How do you invoice?
In US dollars from DX Clouditive LLC, monthly in arrears, net 15, paid by international wire. We do not issue Mexican CFDI invoices.
Does the Privacy Policy cover our project data?
No. It covers dxclouditive.com and the emails we send from it. Data we handle for you during an engagement is governed by the agreement you sign and, where you need one, the DPA.
Tell us your case.
We reply to every request within 1 business day. We sign an NDA before the call if you ask.