Engagement-specific scope
Before implementation, we define which information the work requires, why it is needed, who owns it, and where access must stop.
Trust and operation
How MTM handles information during an engagement.
Governance is part of the system, not a document beside it. This page states current operating principles. Unverified legal or technical detail is not presented as fact.
Page status: approved operating principles as a conservative trust draft. Legal entity, business address, official email, processors, hosting location, and retention periods require Hammad confirmation before public launch.
Principles we design against.
Approved sources only
The system works from authorized sources. Answers and actions must be traceable to visible evidence wherever verification matters.
Least privilege
Access to systems and data is granted only to the extent the work requires, not more.
Human approval boundaries
Sensitive, exceptional, or high-impact decisions stay with authorized people. The system prepares or routes; it does not replace accountability.
Logging and evidence
What entered the system, what it proposed, who approved, what was completed, and what failed is retained to the extent needed for review and operation.
Exceptions and recovery
Every serious capability needs a clear exception path and an owner who can resolve ambiguity or failure.
What we do not claim yet.
- We do not claim security certifications or regulatory compliance before verification.
- We do not publish hosting locations, processors, or retention periods before they are confirmed.
- We do not promise sovereign hosting, zero retention, or technical guarantees that are not proven in the actual delivery environment.
- Legal privacy and terms pages publish only after the legal entity and official contact details are approved.
Shared responsibilities.
What MTM designs for
Scope definition, authority boundaries, exception paths, and an operating record sufficient for review within the agreed engagement.
What remains with the client
Data ownership, designation of approvers, authorization of sources, and decisions the system must never make on anyone's behalf.
For governance or data questions before a formal engagement: use the contact page. Do not send passwords, credentials, confidential records, or regulated information through the public form.