How your data is handled.
What is built, and how each engagement runs, from the diagnostic to the end of the work.
During an engagement
Your accounts
Production builds run in hosting, database and domain accounts opened in your company’s name. You hold the keys; I am added as an administrator, and you can remove me at any time.
One agency cannot read another
Every table uses row-level security in the database, and every build ships with automated tests proving that one agency, customer or vendor cannot read another’s records.
The diagnostic
Runs on a de-identified sample or inside your own environment, without access to your live systems.
No client data in our AI tools
Client data never goes into Loadbearing’s own AI tools or workflows. Demos use fictional data only.
Secrets
Keys and passwords are never written into code or committed to a repository. They live in your accounts’ secret stores.
Review before launch
Each build gets an independent security review before it goes live, priced as its own line on the quote.
Written terms and the end of an engagement
Data processing terms
Every engagement that touches client data comes with a short data processing addendum: what is processed, by whom, and for what.
Breach notice
If a breach affects your data, you are told without undue delay and within 48 hours of it being found.
Return or deletion
At the end, your data is returned or deleted, as you choose, within 30 days, and administrator access is removed.
Questionnaires
Send your vendor security questionnaire with the diagnostic paperwork. It is answered from what is built and written here.
This website’s processors
Cloudflare
Hosts the site and counts visits with Web Analytics, without cookies.
Cal.com
Runs the booking page when you book a call.
Google Workspace
Sends and receives our email.
The full list for outreach is on the privacy page. Security questions: [email protected].