Procurement

Everything a finance, procurement or security function normally has to request. It is published instead, so the questionnaire can be answered from this page.

Identity

• I am registered as Deal Baker Ltd, company number 14906367, in England and Wales.
• Registered office: International House, 64 Nile Street, London N1 7SR.
• I also trade as SignalsAPI, vbdr.
• I perform the work in Norway, remote, 08:00–17:00 CET.

Invoicing

• I invoice in EUR.
• Payment terms: Paid monthly for the same month, before the 25th of that month.
• Cadence: Issued monthly for the same month, before the 10th of that month.
• VAT: Not registered for VAT.
• Purchase orders: a PO number quoted on the order is carried on every invoice for that engagement.
• Next start date: 1 September 2026.

Contact

I am Mykola Vorobiov. I run the engagements, and I sign for Deal Baker Ltd under written authority from its director. hello@dealbaker.io. My stated response time: Two working days.

Data protection

I am the controller for my own business contacts, and the processor for client data handled under an engagement. A DPA is available on request.

Sub-processors: Cloudflare (site hosting, form endpoint, bot mitigation) and Mailgun (transactional email) for this website; Anthropic, OpenAI and MiniMax where an engagement uses an AI provider — which ones apply varies by engagement, and the client is told before work starts.

I do not store submissions to the Brief form. The message travels through the email provider to one inbox, and exists in no database, object store or log.

Security posture

• I use multi-factor authentication on every account that supports it.
• Full-disk encryption is on every machine I use for client work.
• I hold secrets in a password manager and inject them as environment bindings; I never commit them.
• Backup and restore: client data sits in the client’s own repositories, cloud accounts (wherever the vendor permits it) and password manager — not on my infrastructure — so backup and restore stay under the client’s control.
• I patch on the vendor’s stable channel, and review access at the start and end of every engagement.
• Offboarding: I return credentials and revoke access at the end of the engagement, whichever side ends it.
• I am pursuing Cyber Essentials. I do not hold it, and nothing here should be read as a certification.

Personnel policy

One named engineer per engagement. Nobody works on your system without you being told first — no silent substitution, no juniors on your budget. If a specialist is ever needed you get told who, before it happens, and you can say no. That is Term 1 — Provenance.

Continuity

Continuity is provided for rather than promised. See Term 4 — Continuity. The full account, technical and corporate, is on the continuity page. Who is behind the company is on the who page.