Security, access and paperwork

Working as your subcontractor

• You remain the supplier of record. Your client contracts with you; I contract with you. Nothing about your contract chain or your client’s vendor list changes.
• I sign your NDA, your DPA and your framework agreement as they are written.
• I can be introduced as your engineer, join your client’s calls, or stay entirely behind your delivery manager. Your call, stated up front.

Access

• The first week is read-only. A cost or quality review needs SELECT plus query history, nothing more.
• I work inside the client’s environment: their VPN, VDI, bastion host or jump box, whichever you already use for contractors.
• No client data is stored on my machine. Not extracts, not samples, not screenshots of rows.
• Write access, when the work needs it, is scoped to a named role and a named schema, and revoked at the end of the engagement.
• A fixed IP and access logging can be provided if your client’s policy requires them.

Device

• Full-disk encryption, screen lock, and MFA on every account.
• A password manager with unique credentials per client.
• A separate browser profile per engagement.
• No client credentials stored in plain text, ever.

Data transfer, by region

• EU. Morocco has no EU adequacy decision, so the mechanism is the 2021 EU Standard Contractual Clauses, Module 3, with me acting as a sub-processor under Article 28(4). Filled clauses ready to sign.
• UK. Post-Brexit, the EU SCCs do not apply on their own. The mechanism is the UK International Data Transfer Agreement (IDTA), or the EU SCCs plus the UK Addendum (in force since 21 March 2022). I keep both versions ready, whichever your legal team prefers.
• Canada. PIPEDA does not use a fixed transfer-mechanism list like the GDPR. It relies on contractual accountability: your organisation stays responsible for the data, so a standard data processing agreement covers it. If your data includes Quebec residents, Law 25 requires a documented transfer assessment before the engagement starts, and I can complete one on request.
• USA. No single federal privacy law. What is needed depends on your own exposure: CCPA/CPRA for California consumer data, a signed BAA for HIPAA-covered health data, or a GLBA-consistent addendum for financial data. I sign whichever applies.
• Australia. The Privacy Act 1988 and the Australian Privacy Principles (APP 8, cross-border disclosure) do not use an adequacy list either. Contractual assurance that I will not breach the APPs is enough, covered by the same DPA.
• Gulf / UAE. The UAE Federal PDPL (Decree-Law No. 45 of 2021) requires either an adequate destination or appropriate safeguards such as contractual clauses for data leaving the UAE. If your entity sits in the DIFC or ADGM free zones rather than UAE mainland, their own separate data protection laws apply (DIFC Law No. 5 of 2020 / ADGM DPR 2021). Tell me which and I will match the right paperwork. Saudi Arabia has run its own PDPL since 2023 for Saudi-based clients.
• Morocco ratified Council of Europe Convention 108 in 2019, and its national regime (Law 09-08, enforced by the CNDP) carries criminal penalties for data-protection breaches.
• In practice the transfer question is usually moot: the work happens inside your client’s environment and no personal data leaves it.

Commercial

• Invoiced monthly in EUR or GBP from my registered business, with a tax ID on the invoice. Services exported from Morocco are VAT-exempt, so there is no VAT line to reconcile.
• Payment by bank transfer, 30 days net.
• Professional references available on request.

Continuity

• Code and documentation land in your repository, not in a private workspace of mine.
• A written standup every working day, so progress is visible without a meeting.
• Two weeks’ notice and a written handover, in the contract.

If your client has a security questionnaire, send it. I would rather answer it in week one than discover it in week three.