How we work
How we deliver, and how we keep your data safe
A short assessment before a long build, the data foundation before the model, and security, privacy and AI governance designed in from the first phase. Every engagement is planned so your team can take it over.
Phases
Four phases, each with something you keep
-
Phase
Assess
- Profile the data, map the systems
- Test one hard question end to end
- You receive: architecture, risk register, costed roadmap
-
Phase
Foundation
- Pipelines, contracts, storage, access model
- Quality gates and lineage before any model
- You receive: a governed, tested data platform
-
Phase
Build
- Reviewable increments
- Against an evaluation set agreed up front
- You receive: working system, eval harness, runbook
-
Phase
Operate
- Monitoring, tracing, cost ceilings, retraining
- Handover or a managed retainer
- You receive: observability, SLOs, trained owners
Engagement models
Four ways to start
Most engagements begin with the assessment, because it is the cheapest way to find out whether the rest is worth doing.
Model 01
Assessment
A fixed-scope, fixed-price diagnostic over two to three weeks. Architecture, risk register and a costed roadmap you keep regardless of what happens next.
Best when the problem is clear but the path is not
Model 02
Project delivery
An outcome and a date. We own scope, architecture and delivery, working in reviewable increments against acceptance criteria agreed up front.
Best for a defined platform or product build
Model 03
Embedded engineers
Named senior engineers inside your sprints, your tooling and your standards, with our review process behind them. Onboarded within a week on monthly terms.
Hire forward deployed engineers
Best when you have the roadmap and need the capacity
Model 04
Advisory and training
Architecture review, AI governance framing and hands-on training in data science, generative and agentic AI, and BI, so your team can run and extend what has been built.
Best alongside an internal build or a handover
Commercial posture
Fixed price on assessments and clearly bounded scopes. Time and materials where discovery is genuinely open. Retainers for operate-phase support. We will recommend the smaller engagement when the smaller engagement is the right one.
Commitments
Four things you can hold us to
Not values. Commitments a client can check on any Friday of the engagement.
We ship the boring layer too
Migrations, access control, retries, dead-letter queues, runbooks and exit codes. The work that decides whether a system is still running in month six, and the work most AI vendors leave for your team to discover.
Quality is measured, not asserted
Evaluation sets agreed before the build. Regression runs on every prompt and model change. Tracing on every call. If we cannot measure a claim, we do not make it in the status report either.
Built to be taken over
Your repositories, your cloud accounts, your documentation, written as we go rather than at the end. We plan the handover in phase one, including the training your team needs.
Senior people on the actual work
Small teams, direct access, no layer of account management between you and the engineers. At least one founder stays on the account for its duration.
Delivery practice
How the work is run day to day
Specifications are the source of truth
On product builds, a written specification sits above the code: a mission, a technology stack and a numbered roadmap. A traceability file records which requirement each feature satisfies.
The pipeline is the reviewer
Linting, strict type checking, unit and integration tests, schema drift detection, isolation checks and browser end-to-end runs execute on every push. A red pipeline blocks a release, including ours.
Honest status, including the gaps
Each project keeps a known-gaps register that says plainly what is not finished and what cannot be verified without infrastructure or a person. Clients read the same register we do.
Getting a quote
What we need, and what you get back
What we need from you
- The decision or workflow you want to change, in one sentence
- Where the data lives today, and roughly how much there is
- Any regulatory, residency or procurement constraint that is non-negotiable
- The date something has to work by, and what happens if it does not
- Who inside your organization will own the system afterwards
What you get back
- A written architecture, not a slide with boxes on it
- A phased plan with a cost against each phase
- An honest view of what will be hard, and what we would not do
- A named team, with the people who would do the work
- A recommendation to stop, if stopping is the right answer
Security and trust
What ships with every engagement, by default
A regulated buyer should not have to ask for any of this. These are defaults, not upsells, and they apply to the systems we build and to how we work with your data.
We do not currently hold a company certification such as SOC 2 or ISO 27001, and we will not describe ourselves as "HIPAA certified" or "GDPR compliant", because those phrases mean less than buyers are led to believe.
What we do instead is design and deliver systems that support your obligations under HIPAA, GDPR and Saudi PDPL, document the controls, and let you verify them. Life sciences engagements run under confidentiality agreements, and we describe those clients by sector only.
We are happy to complete your security questionnaire and to discuss contractual data protection terms during the assessment.
Delivery standards
Four defaults
Security
Least privilege by default
Separate roles for migration, request handling and background work. Row-level security enforced in the database, not in application code.
Privacy
PII handled deliberately
Detection, redaction and retention policy defined in phase one. Data residency and deployment location treated as an architecture constraint.
Quality
Automated gates on every push
Linting, type checking, unit and integration tests, schema drift detection and end-to-end runs. A red pipeline blocks a release.
Operations
Observable and resumable
Structured logs, traces and per-run cost tracking. Long jobs resume at the point of failure instead of restarting from zero.
- Test coverage on our recommendation platform's FastAPI services, load tested at 50 requests per second
-
95%
- Automated tests passing on our offline-first finance app, static analysis clean
-
176
- Model calls traced, with prompts versioned outside the codebase
-
100%
- Client identifiers or credentials stored in application code
-
Zero
AI governance
How we control model risk
Hallucination, drift and unintended actions are engineering problems with engineering answers.
Grounded, cited outputs
Retrieval systems answer from your sources and cite the passage, record or clause behind each claim. Below a confidence threshold, the system says it does not know.
Evaluation before and after launch
A held-out evaluation set agreed before the build, regression runs on every prompt and model change, and LLM-as-judge scoring where it adds signal, checked by people where the outcome matters.
Human in the loop where it matters
Drafting and analysis can be automated. Sending, filing, approving and writing to systems of record wait for a named person, and their decision is recorded.
Rules enforced by the system, not the prompt
Read-only access, required data source on every call, and rejected write operations are properties of the query layer. A prompt can be manipulated; a policy in code cannot.
Full traceability
Every model and tool call is traced against the prompt version, input and cost, and configuration is snapshotted per run, so any output can be reproduced and explained.
No model lock-in
Model calls go through one gateway with a registry behind it, so you can switch providers, or move to self-hosted open-weight models, for cost, accuracy or residency reasons.
Regulatory alignment
Frameworks we design for
Alignment means the system is designed to support your obligations. Responsibility for compliance stays with the data controller, and we make that easier to demonstrate.
| Framework | Applies to | How we support it |
|---|---|---|
| HIPAA | US healthcare data (PHI) | PHI identified in phase one, de-identification and redaction, least-privilege access, row-level security, audit trails, deployment inside your environment when required. |
| GDPR | Personal data of people in the EU and UK | Data minimization, purpose and retention defined up front, access control, deletion and export paths, residency treated as an architecture constraint. |
| Saudi PDPL | Personal data processed in or about Saudi Arabia | Direct delivery experience: we built a PDPL document compliance platform that is live with Saudi banks and finance companies. |
| SOC 2 style controls | Security, availability and confidentiality expectations of enterprise buyers | Change control through CI gates, least privilege, logging and tracing, documented runbooks. We do not hold a SOC 2 report and do not claim one. |
Data handling
Your data, your accounts
- Work happens in your repositories and cloud accounts wherever possible, so data does not need to move to ours
- Deployment on AWS, Google Cloud, Azure or on-premise, including deployments that cannot leave a jurisdiction
- Open-weight models served inside your environment when documents must not reach a third-party AI provider
- Sensitive fields identified in the first phase, with redaction and retention rules agreed before build
- No client identifiers or credentials in application code; configuration and secrets held outside it
- Access removed and handover completed at the end of the engagement, as planned in phase one
Cross-border access
Our engineers work from Pakistan. Here is what that means for your data
For US health data, EU personal data or data that must stay in Saudi Arabia, the question is not where our team sits but what it can reach. We agree the access model in phase one and write it into the architecture document:
- Preferred: we work inside your cloud account or network through access you grant, log and can revoke. Data stays in your jurisdiction; our engineers operate on it remotely.
- Where possible: development and testing use de-identified, synthetic or sampled data, so production personal data is never needed.
- Where transfer is unavoidable: we agree the contractual safeguards your regulator requires, such as standard contractual clauses for GDPR, before any data moves.
If your policy does not allow offshore access to a dataset at all, tell us early. We will say whether the work can be designed around it, or whether we are the wrong partner for that part.
FAQ
Delivery and security questions
Who owns the code and IP?
You do. Code, infrastructure and documentation live in your repositories and cloud accounts from day one. Ownership terms are set out in the contract before work starts.
How do you avoid vendor lock-in?
By design. Your accounts, open and widely used tools where they fit, model access through one gateway so providers can be swapped, documentation written during the build, and a handover plan agreed in phase one.
Can you provide engineers to join our team?
Yes, through the embedded team model: named senior AI, data or BI engineers working in your sprints and tools, with our review process behind them.
Do you offer training?
Yes, as part of advisory and training engagements: hands-on programs in data science, generative and agentic AI, and BI, tailored to the systems your team will own.
Which time zones do you work in?
Our team is based in Pakistan and works with clients in the United States, the Gulf and elsewhere. We agree overlap hours and communication cadence at the start of each engagement.
Are you SOC 2 or ISO 27001 certified?
No. We do not hold either today. We apply controls of the kind those frameworks expect, document them, and will complete your security questionnaire so you can assess them directly.
Will our data be used to train AI models?
Your data is processed only for your engagement. Where hosted model providers are used, we select enterprise terms appropriate to your requirements, and where that is not acceptable we deploy open-weight models inside your environment.
Can the system run entirely inside our cloud or data center?
Yes. Pipelines, databases and open-weight models can all run inside your environment. Several of our systems are designed for exactly that.
How do you stop an AI system from making things up?
Grounding in your sources, required citations, confidence thresholds, evaluation on every change and human review where decisions have consequences. We report measured quality, not impressions.
How do we report a security issue with this website?
Email contact@involabs.ai with the details. We acknowledge reports within one business day.
Bring your security questionnaire
We will answer it in writing, and walk your team through how the proposed system is delivered and how it handles data, access and model risk.