Skip to content

How we work

A clear method, compliant from day one.

Five phases, approved one by one, timings and costs in writing, and compliance built into the project rather than added at the end.

The method

Five steps, no leap in the dark.

You always know what is happening and what it costs. If a piece of work isn’t right for you, we tell you up front.

  1. Listening

    We start with you: how the business works, what is costing you time or customers, where you want to get to. In person too, in the province of Latina.

  2. Assessment

    We look at processes, tools and numbers to see where it’s worth stepping in, in what order, and where it isn’t.

  3. Proposal

    We put in writing the goals, the phases, the timing and cost of each phase, and what will remain yours. Work starts only when you give the go-ahead.

  4. Trial

    We build a first working piece on your data: you actually use it before committing to the rest.

  5. Delivery

    We hand over the finished project, documented and yours, with training for the people who will use it. If you like, we keep developing it.

The written proposal

What you get in black and white.

Before we start, you receive a document you can follow without being technical.

  • 01
    Goals

    What needs to change in your business and how we will measure it.

  • 02
    Phases and costs

    Each phase with what it delivers, what it costs and how long it takes. You approve one phase at a time.

  • 03
    What stays yours

    Code, data, access, brand, documentation: yours, with no licences that expire.

  • 04
    Who does what

    Your contact person, who works on the project, and what we need from you.

  • 05
    Data and security

    Where the data is kept, who can access it, what happens when we stop working together. With a formal appointment as data processor when we handle data on your behalf.

  • 06
    After delivery

    Support and maintenance, if you want them, on clear terms.

Our principles

Three principles behind everything.

Made to measure

Everything is built around your processes and the way you work, starting from what the business owner needs, not from the technology.

Tangible results

Results you can see and measure. No hot air, no promises: a working trial before any commitment.

Simplicity

We take care of the complexity. You get tools that are quick and easy to use, and someone to ask.

Compliance

Compliant, from day one.

Compliance isn’t a stamp added at the end: it is built into the system from the first line of code. Here is how, law by law: open each card.

  • Compliant with the law

    GDPR, AI Act and Italian law, from the start.

    Every project starts within a stated legal framework: the GDPR for personal data, the AI Act for artificial intelligence systems, Italian law for contracts and liability. It isn’t an adjustment made at the end: it is the starting point of the design.

    GDPR · Regulation (EU) 2016/679

    Data protection by design and by default (Art. 25). Every processing activity has a stated legal basis (Art. 6), collects only the data it needs (Art. 5) and is covered by appropriate technical and organisational measures (Art. 32). When we process data on your behalf, we do so as a data processor, under a written agreement pursuant to Art. 28: roles, instructions and obligations, in black and white.

    AI Act · Regulation (EU) 2024/1689

    Europe regulates AI according to risk, and we design accordingly: anyone interacting with an AI system must be told so (Art. 50), the actions that matter stay under human oversight, and every decision can be traced back. The regulation applies in stages, recalibrated in July 2026 by Regulation (EU) 2026/1744: getting there ahead of the deadlines is part of the method. The stages, explained: the AI Act for small businesses.

    Italian law

    Contracts governed by Italian law: the Civil Code (Codice civile), the Privacy Code (Legislative Decree 196/2003) and Law 132/2025, Italy’s first national law on artificial intelligence, which works alongside the AI Act on transparency, liability and the protection of individuals. Italian jurisdiction, Italian language, no hidden clauses.

    references · Regulation (EU) 2016/679 · Regulation (EU) 2024/1689 · Regulation (EU) 2026/1744 · Legislative Decree 196/2003 · Law 132/2025

  • Protected data

    In Europe, with controlled access and everything logged.

    Your data is not our product: it is working material you entrust to us. Its boundaries are set before we start: where it is stored, who can access it, for how long, and what happens when the relationship ends.

    Location and transfers

    The infrastructure is hosted in data centres in the European Union. Outside providers are brought in only under contracts pursuant to Art. 28 GDPR, and any transfer outside the EU is allowed only with the safeguards of Chapter V of the regulation, such as standard contractual clauses. No hidden data flows: every step is declared and documented.

    Access kept to the minimum

    Every person, and every AI agent, can access only the data needed for their task. Encrypted connections, named accounts, administrative privileges kept to a minimum and logged.

    Traceability and oversight

    Every relevant AI action goes into a log: what was asked, what was done, who approved it. Operations with real-world effects need a human go-ahead. This is what makes compliance demonstrable, even in the worst case, when the GDPR requires a breach to be reported to the Italian Data Protection Authority (Garante) within 72 hours.

    Ownership and exit

    Your data stays yours: kept only as long as its purpose requires, data subjects' rights can always be exercised (access, rectification, erasure, portability: Arts. 15–22) and, when the relationship ends, the data is returned or deleted with documentation, as Art. 28 requires.

    references · GDPR Arts. 5, 6, 15–22, 25, 28, 32–34, 44 et seq.

  • Certified infrastructure

    Built on ISO/IEC 27001-certified providers.

    A system is only as secure as the hardware it runs on. That’s why we only choose infrastructure providers certified to ISO/IEC 27001, the international standard for information security management, with data centres in the European Union.

    What the standard guarantees

    An ISO/IEC 27001-certified provider maintains a security management system that is checked by independent audits and renewed over time: control of physical and logical access, risk and incident management, business continuity. It isn’t a self-declaration: it is a third-party check.

    Above the infrastructure

    At application level the same rigour applies: separate development and production environments, regular security updates, backups, administrative access kept to a minimum and logged. A chain is secure only if every link is, from the data centre to the code.

    references · ISO/IEC 27001 · EU data centres · regular checks of providers' certifications

legal references updated to September 2026 · the practical details of each project are set out in writing before we start

Contact

Want to see the method on your own case?

A free assessment, 30 minutes, no commitment: we work out where to act and in what order. Clear times and costs before we start.

reply within 24 business hours 1 of 3

Request the assessment

01 · what you needWhat do you need?

Pick more than one if you like: it helps us prepare.

Tell us in a couple of lines (optional)
02 · how to reach youHow should we get back to you?

One contact is enough: phone or email.

03 · whenWhen would you like us to call?

We’ll call you back within 24 business hours, in the time slot you choose.

No commitment, reply within 24 business hours. We use your details only to reply to you.