Security, ownership and access: how we handle your work and data

The short version, for a vendor form

Each answer is explained further down this page.

• Dardo is a founder-led design and development studio in Bogotá, Colombia (UTC−5 all year), founded in 2026. Three people, led by Nicolás Cerón, working in English and Spanish.
• Every engagement starts from a written proposal naming the people, scope, price and ownership. It also says how each deliverable is accepted and who owns each account and file at handover.
• You own the custom design and code you pay for. Fonts, stock images, plugins and open-source libraries stay under their own licences.
• Hosting, domain, DNS, CMS, analytics, code repository and email-sending accounts are in your company's name. We are invited as users.
• Access is one login per person, with the lowest role that does the job and no shared passwords. You remove it at handover, or keep it under a maintenance plan.
• Production data and customer records stay in your systems. We ask only for the access a task needs.
• We hold no SOC 2 report or ISO 27001 certificate.

Who owns the work, and when ownership passes

You should own the custom design and code you pay for, and the contract should say so. Our proposal states who owns the code, the design assets and the licensed dependencies before work begins.

The US Copyright Office explains that a commissioned work is a “work made for hire” only if it falls into one of nine categories, such as a translation or a contribution to a collective work, and both parties sign a written agreement saying so. Website code and design aren't named in that list. That's why contracts with outside studios usually add an express assignment of copyright, which US law requires to be in a signed writing. Check that the contract covers:

• Assignment of copyright in design files, source code and documentation to your company
• When ownership passes; final payment is the common point
• What stays licensed rather than owned: fonts, stock images, plugins and open-source libraries
• Governing law and where disputes are settled

This is general information, not legal advice; ask your counsel to review the clause. Payments, tax forms and shared working hours are covered in working with a studio in Colombia.

Accounts in your name, access per person

Every account the website depends on should belong to your company, with Dardo invited as a user. That's our handover rule: hosting, domain, DNS, CMS, analytics, the code repository and email-sending accounts sit in your company's name. If they don't yet, moving them is the first task.

Recurring third-party costs, such as the domain, hosting, CMS plans and font licences, appear as their own lines in the proposal, at each provider's price. Ending an engagement never means losing access to your own site.

How access works:

• We ask only for the access a task needs, as invitations to our own logins: one per person, never a shared password.
• Each login gets the lowest role that does the job. Some jobs need more: a migration needs admin access to the current CMS, the domain registrar and DNS, hosting, Search Console and analytics.
• Turn on multi-factor authentication, starting with admin accounts. CISA calls phishing-resistant methods, such as FIDO security keys, the gold standard, and warns that codes sent by text message are open to phishing and SIM swap attacks.
• Because the accounts are yours, you can remove our access yourself. At handover you remove it, or keep it under a website maintenance plan.

NDAs and confidentiality

If you need an NDA, it belongs in the contract, alongside governing law and where disputes are settled. Whose template is used, and whether we may show the project in our portfolio, is agreed in the proposal or contract.

Confidential material can stay in your own tools. We can work in your Slack, project tracker or GitHub organization, so files and history stay with you. Production data and customer records stay in your systems.

Where files, messages and inquiries live

• Code: in a repository in your company's name.
• Designs and reviews: on a staging link or in Figma comments. The proposal says who owns each file at handover.
• Decisions: the proposal, scope, acceptance criteria, the decisions after each review and the handover notes are written down, in English for US clients unless you ask otherwise.
• Email: the studio's Gmail inbox, on Google Workspace.
• Inquiries sent through our site: a private Cloudflare D1 database, with a copy sent through Cloudflare Email Service to the studio's Gmail inbox. Access is through the studio's Cloudflare account, and the inquiry database doesn't store IP addresses.

On our own site, Google Analytics and PostHog's US cloud measure visits by default. Events exclude names, emails, inquiry references, form contents and full URL queries. Session replay masks inputs, leaves forms out and is kept for 30 days. Advertising cookies, ad personalization and remarketing stay off. Cookie settings in the footer turn analytics off, and Do Not Track and Global Privacy Control keep it off.

If you reach us from a Google or Microsoft ad, the inquiry keeps that ad's click identifier, and we tell the ad platform, by that identifier alone, whether the click became an inquiry or a project, with the project's value. Your name, email and brief never go to an ad platform. To ask what we hold, correct it or have it removed, write to us; our privacy notice has the address and the full detail.

Personal data on the site we build for you

On your site, your company decides what the forms collect and where each submission goes. Forms, analytics and integrations send data to accounts your company holds, and outside services, such as a CRM, booking, payments or email sending, appear in the proposal as their own lines.

If a task means handling personal data your company holds, such as a customer export for an import or a CRM connection, the contract should say what we may do with it, for how long, and how it is returned or deleted.

When we move or redesign a site, forms, analytics, consent and integrations are rebuilt and tested, and the destination of every submission is checked. The analytics events, conversions and consent banner are checked on the new templates before launch.

AI tools, reviews and who approves what ships

Which AI tools may be used on your project, and what they may see, is agreed in the proposal or contract. If your company has a policy on AI tools, send it with your brief.

The people named in the proposal, by name and role, do the work, and you talk to them directly, including the founder. Each deliverable is accepted against criteria the proposal sets out. Reviews happen on a staging link or in Figma comments, and the decisions after each review are written down.

In a website migration, the new site is built on a staging address that search engines are told not to index, and the old site keeps working until a planned switch. Someone on your side approves redirects for pages with business or legal weight, such as policies or product pages.

What Dardo is not

• Not certified. We hold no SOC 2 report or ISO 27001 certificate.
• Not a US company. If your process needs a US legal entity, specific insurance certificates or security audit reports, ask early: we may not meet them, and a local US agency may fit better.
• Not a staffing firm. We deliver scoped projects; we don't place individual developers under your managers' daily direction.
• Not a large team. Three people can't absorb a sudden doubling of scope or staff a year-long program that needs ten. The studio was founded in 2026, so judge it by its published work and by what the proposal commits to in writing.

If your requirements rule us out, we'd rather say so in our first reply than send a proposal that doesn't fit.

What happens at handover

• Every account confirmed in your company's name: hosting, domain, DNS, CMS, analytics, repository and email sending.
• Our access removed, unless you keep it under a maintenance plan.
• Written handover notes.
• After a migration: the redirect list, so any developer can maintain it; DNS and accounts handed over; and a date to cancel each old plan, so nothing renews or lapses by surprise.
• Old hosting is cancelled only once the new site answers every URL, you hold a full export and backup, and no redirect depends on it. The domain stays yours.

If you keep us on, maintenance starts at USD 79 a month: uptime, SSL, domain and form monitoring, backups with restore tests, urgent security updates and a monthly report. Response times are set after an initial audit. Every published price is on our pricing page.

Questions before you choose