What it is like to buy us.

Choosing the engineering team is the quick part. Getting that choice through procurement, security and legal is what takes the quarter — and it takes the quarter because the answers arrive one questionnaire at a time.

So they are all here instead: the entity that signs, the contracting shape, payment terms, the access and data model, the insurance position, subcontracting, and how an engagement ends. Settled positions rather than opening offers, written down before anyone asks for them.

This page is for the sponsor who has to defend the choice, and for the procurement, security and legal readers who assess it after the technical evaluation has already gone well. It is meant to be printed, forwarded, or pasted into an internal email, and it is built to survive all three.

If you are still deciding whether you want the work at all, this is the wrong page — start with services, industries or technologies, and come back here when the engineers are convinced.

Contracting entity

Fluvius USA Inc — a US corporation

Registered address

1401 21st St, Ste R, Sacramento, CA 95811, United States

Jurisdiction

US contracts, US payment terms. Led from Ireland, senior team across Europe.

Operating hours

EU hours with full US-morning overlap — a written handoff is waiting at the start of a US day

Trading since

Brand founded 1 November 2017 · 200+ clients served

Publicly checkable

Clutch — 4.9/5, from interviews conducted directly with clients

01 — Institutions that have already bought us

The access is the point, not the feature list

Each of these required somebody’s procurement, security and legal function to say yes to us first. That is the part worth citing to a committee.

UAE retail bank — engineers on-site, inside the bank

RAKBANK — a customer-facing onboarding journey, built in the bank’s own environment

Our engineers worked on-site at the bank on a compliance-grade digital onboarding flow, inside its environment, its review process and its release path. Banks do not grant that access to suppliers they have not diligenced, and the diligence came before the code. Bank onboarding case →

Foreign ministry — live in both public app stores

Ministry of Foreign Affairs of Qatar — a national application in production

The Ministry’s official application, built by us and shipped on iOS and Android in English and Arabic with full right-to-left layout. A government review process and a national brand, in public, where anyone can download the result. Qatar MoFA case →

National health platform — delivered under pressure

A national public-health programme in the Caribbean — inbound travel and health protocols

A national platform managing inbound travel and health protocols, delivered under pandemic conditions where the deadline was set by circumstances rather than by a roadmap. See the work →

Two people from Fluvius standing in a client's open-plan office, with the client's own team working at desks in the room behind them — Working on the client’s floor, in the client’s environment — the arrangement this page is describing. About Fluvius →

02 — How we work inside your environment

What stays yours, what we are given, and for how long

The short version: everything of consequence stays in your name. We work inside your accounts rather than around them, and access is granted deliberately and time-bounded rather than requested ad hoc.

Responsibility and boundary — the standard arrangement
What	Whose	How it works in practice
Source code	Yours	In your repositories, under your review path and your branch protection, from the first commit rather than at handover.
Cloud accounts & infrastructure	Yours	Your VPC, your accounts, your billing. Infrastructure as code lives in your repository so an environment can be rebuilt without us.
Credentials & access	Yours	Least-privilege roles under named human identities, scoped to the work and time-bounded. You grant them, you rotate them, and you can revoke them the same afternoon without asking us.
Production data	Yours	It stays where it is. For test data we build synthetic or masked fixtures rather than taking a copy of production.
Domains, DNS & certificates	Yours	In your registrar and your zone throughout. No part of the engagement leaves you unable to point a name somewhere else.
Documentation & runbooks	Yours	Written for whoever inherits the system rather than for us, and delivered as work proceeds rather than as a final phase.
Engineering work	Ours	Design, implementation, tests and review, with a senior architect signing off the architecture before development starts.
Our own tooling	Ours	Laptops, editors and internal workflow. Where a tool of ours would touch your data, it is raised and agreed before it is used.

The test we apply to every one of these: if the engagement ended without notice on a Friday, could your team keep going on Monday using only what is already in your accounts? If the answer is no, something in the arrangement is wrong and we would rather fix it in week one.

03 — The contractual shape we are used to

The clauses, and our position on each

These are the questions that appear in every vendor agreement and every due-diligence questionnaire. Our positions are below so that the first redline cycle is shorter, and so that a sponsor can answer procurement without waiting for us.

Whose paper

Yours, on terms that work both waysMaster services agreements, data processing agreements and NDAs on your template are normal here. We read them properly and come back with a short, specific list rather than a clause-by-clause negotiation.

We also bring our own agreement, refined across a decade of delivery, and the parts clients most often adopt from it are the ones that make the work faster: a defined acceptance window, a named replacement guarantee, and a trial period either side can use. Where a proposed term would slow the work down or lower its quality, we say which one and what we would put in its place. That conversation belongs in week one, and it is short.

Payment — monthly in advance

StandardWe invoice monthly. The prepayment invoice for the following month is issued no later than the 25th of the current month, and is due within seven calendar days of issue. The first invoice covers the period from the start of work to the end of that month and is due within ten days of signing. Where actual services differ from the invoiced plan, the difference is adjusted on the next invoice rather than settled separately.

Payment — direct debit

AlternativeFor organisations that pay in arrears, we run direct debit through the scheme you already use — ACH in the US, SEPA in the EU, Bacs in the UK, pre-authorised payments in Canada. The invoice and a pre-notification with the exact date and amount go out on the 27th of the month worked; funds are drawn on the date in that notification, usually the 3rd of the following month. Nothing is ever taken without the pre-notification, and your bank’s own dispute process applies unchanged.

Audit and inspection rights

AcceptedYou may inspect the processes and records relating to the engagement. We also cooperate with incident investigation and notification obligations under the terms of your agreement.

Subcontracting

Disclosed by defaultWhoever touches your work is named before the contract is signed rather than discovered during it. This is the question in every vendor questionnaire and the answer does not change depending on who is asking.

Exit and transition assistance

In the contractHandover, documentation, credentials and knowledge transfer are contractual obligations rather than goodwill at the end. Leaving should be an inconvenience and never a hostage situation, and the arrangement above is what makes that true in practice.

Insurance

CarriedWe carry cover at the levels our clients’ contracts have typically required. Certificates are provided during procurement with the completed questionnaire rather than published here, and where an engagement requires a specific limit or coverage type we arrange it as part of contracting.

Intellectual property

Yours, worldwideSource, documentation, infrastructure definitions and credentials are yours at every stage of the engagement, not on final payment. The transfer carries no time limit and no territorial limit, and anyone we engage on the work assigns their intellectual property to you in writing before they touch it — the clause most agreements leave out, and the one your acquirer’s counsel will look for.

Accountability

Named, seniorA named senior person is accountable for delivery, architecture is signed off by a senior architect before development starts, and you talk to the engineers doing the work rather than to an account-management layer.

Guarantees we write in

Standard, not negotiatedA trial period at the start during which either side can stop. A defined acceptance window on delivered work, so nothing sits in limbo. And a replacement guarantee: if an engineer is not performing, we propose replacements at the same level or better within thirty days, at a reduced rate while the change is made, with no termination fee attached. Most suppliers offer none of these; we put them in the agreement because they are what a serious buyer would ask for anyway.

Confidentiality and what we may say afterwards

Mutual, and it does not expireConfidentiality binds both parties and survives the end of the engagement rather than lapsing with it. What we may publish about the work afterwards is limited to a high-level description — the technology stack and the roles on the team — and nothing beyond that without your written consent. Several engagements on this site are described exactly that way and no further.

Governing law

Your jurisdictionDisputes are resolved in the competent court at your location rather than ours. That is our standard position and it is the opposite of the one most suppliers open with.

On this page the invitation is the procurement conversation rather than the technical one. Bring the questionnaire, the vendor agreement, or the person who will have to sign — before anyone writes code.

04 — The shape of a first engagement

What the first ninety days look like from your side

Step 01 — Mutual NDA, then a scoped first piece

One journey, one subsystem or one written audit, with a date and a fixed price. Small enough to buy without a committee, real enough to prove the working relationship before anyone commits to a programme.

Step 02 — The questionnaire, answered in two business days

Security and vendor-risk questionnaires come back completed within two business days. They are answered by the engineers who do the work rather than routed through a function, which is why they are both fast and accurate. Send it before the first call if you want the review running in parallel.

Step 03 — Contracting

Fluvius USA Inc signs, on your paper, under US contracts and US payment terms. The positions in section 03 above are our starting point rather than a negotiating stance, which is what makes the first redline cycle short.

Step 04 — Access and environment

What we need, at what privilege level, and for how long — written down and agreed before anything is granted rather than requested ad hoc during the work. The table in section 02 is the template.

Step 05 — Delivery cadence

A weekly demo of working software, written status in your own channel, a named senior person accountable, and architecture signed off before development starts. Nothing about the reporting requires you to chase it.

Step 06 — Exit, from week one

Documentation, credentials and a handover plan exist from the beginning rather than being assembled at the end. The work should be able to continue without us, and that is a design constraint rather than a courtesy.

Fluvius at an innovation centre in Dublin, standing beside the innovation exchange banners — Led from Ireland, senior team across Europe, contracting through a US entity. About Fluvius →

05 — The questions a committee asks

Asked plainly, answered plainly

“Are you big enough for us?”

Possibly the fairest question on this page, and one we would rather answer than have raised in a room we are not in. We are a large senior engineering team, and scaling an engagement to around forty engineers inside a month is planned capacity rather than improvisation. The stronger answer is the record: engineers on-site inside a UAE retail bank, a ministry’s application live in both public stores, a national health platform — each of which required somebody’s procurement and security function to clear us first.

“Do you hold SOC 2 or ISO 27001?”

We hold neither, nor HIPAA certification, and we would rather tell you that in week one than have it surface in month three. What we work to instead is your control environment: your accounts, your access model, least-privilege time-bounded roles under named identities, and credentials you own and rotate. Where a certification is a hard requirement for the engagement, say so early and we will tell you plainly whether the timeline works.

“What if your key person leaves?”

A real concentration risk, and we would rather name it than have it raised in a committee we are not in. Documentation and handover are deliverables from week one, code and credentials are yours throughout, and no part of the work is designed so that only one person can continue it. The test in section 02 is how we check that rather than assert it.

“Will you sign our paper?”

Yes — your MSA, your DPA, your NDA. And the clauses most often queried are already settled positions here: audit and inspection rights accepted, subcontracting disclosed by default, incident cooperation, and exit and transition assistance written into the contract. We would rather have that conversation in week one than in the security review.

“Will you subcontract this?”

Whoever touches the work is disclosed before the contract rather than discovered during it. That answer does not change depending on the size of the engagement or who is asking, which is the only version of it worth having.

“Where will our data be?”

In your environment. We work in your VPC, your repositories and your accounts, with time-bounded least-privilege roles under named identities. Where we need test data we build synthetic or masked fixtures rather than taking copies of production. The bank work was done inside the bank.

“Communication will be slow and we will be waiting a day for every answer.”

The working day is built around yours. Delivery runs on EU hours with full US-morning overlap, so there is a live window every day and a written handoff already waiting when your morning starts — which is faster than a same-timezone supplier who replies in the afternoon. On top of that: a weekly demo of working software, written status in your own channel, and direct access to the engineers rather than a message relayed through an account manager. And when the work needs someone in the building, our engineers have been in the building — the bank onboarding journey was built on-site inside the bank.

“Procurement will take four months and kill it.”

That is usually attrition rather than refusal — a redline cycle per clause because the supplier has never seen a vendor agreement. This page exists to shorten that: the positions above are our starting point, the questionnaire is answered by people who know the answers, and the first piece of work is small enough to buy without a committee.

06 — The record

Independently checkable, because verification is your job

A Fluvius founder in New York's financial district, One World Trade Center behind — New York — we meet clients where their business is. About Fluvius →

200+

Clients served

10+

Years of happy clients

Years clients stay with us

4.9/5

Clutch rating — client interviews

The Clutch rating of 4.9 out of 5 is not ours to edit: it comes from interviews Clutch conducts directly with our clients, and you can read those interviews rather than take the number. Many of those clients have worked with us for seven years or more, which is a harder thing to arrange than a good review.

The engineering evidence behind all of it sits on our work, the technology pages and the industry pages, each of which names its limits as well as its results.

07 — The document procurement actually wants

The supplier summary, on one page

Everything above, condensed into a single dated page a sponsor can forward without editing: entity and jurisdiction, insurance position, the contractual clauses we accept as standard, the access and data-handling model, named accountability, the exit and transition approach, and the certifications we do not hold.

We produce it on request and date it the day it is sent, so nothing in it is stale by the time it reaches a committee.

08 — Next

Bring the questionnaire, the agreement, or the person who signs.

A free 30-minute working session. On this page it is deliberately not the technical conversation: bring the vendor questionnaire you need completed, the agreement you need read, or the colleague who will have to defend the choice internally, and we will work through the shape of it before anyone writes code.

You keep whatever we produce in that half hour either way, and nobody follows up more than once.

Elsewhere → Services · Industries · Technologies · Our Work · About