Company-Wide Confidentiality & Non-Disclosure Policy

1. Where this policy applies

Rehost is operated by Hidaku LLC. This policy sets our company-wide standard for handling confidential information from clients, prospective clients, partners, suppliers, and other organizations we work with.

Our duties apply when you interact with our team, join a meeting, or share information through our websites, Rehost-operated subdomains, client portal, CRM, company Google Workspace, or other approved work systems. They also apply to information received in person, by phone, in messages, in documents, or while working remotely or traveling.

You do not need to become a paying client for us to treat confidential information shared during an authorized project or business discussion under this policy.

2. What we keep confidential

Confidential information is private information that is marked confidential or that a reasonable person would understand to be private because of its nature or the circumstances in which it was shared.

• Meeting statements, private messages, notes, recordings, transcripts, and project discussions.
• Physical product ideas, software ideas, prototypes, designs, business plans, pricing, and financial information.
• Source code, private repositories, credentials, security details, workflows, methods, and unpublished technical plans.
• Client records, customer data, partner information, and other restricted material entrusted to us.

These duties cover spoken, written, digital, and physical information. Recording or transcribing a meeting requires the notice and consent required by applicable law.

3. Use only for the agreed work

We may use confidential information only to evaluate the opportunity you bring to us, carry out the work you authorize, or provide the agreed support. That permission does not extend to unrelated projects or personal gain.

We must not use your private statements, ideas, data, or intellectual property to benefit ourselves personally, another client, a competing product, or another business without your express written permission. This includes using private partner conversations to advance an unrelated Rehost initiative or a company in which anyone involved has a financial interest.

We must not reverse engineer, reproduce, or replicate your confidential products, code, workflows, or methods outside the agreed work. We must not use confidential information to undermine you, your organization, your product, or your intellectual property.

These restrictions apply to direct and indirect use. A lack of intent does not excuse unauthorized use or disclosure. We must take reasonable care to prevent accidental misuse and respond promptly when we discover a problem.

Sharing information does not transfer ownership or grant a license beyond the authorized purpose. Software ownership, licenses, repository access, and delivery rights remain subject to the signed project agreement.

4. The same rules apply to partner information

We protect a partner's confidential information under the same standard. This includes information received in dealings with Amazon, Google, Google Cloud, Anthropic, and other third-party companies. We must not carry private conversations, data, code, or methods from one relationship into another company's work without permission.

A commercial relationship or access to a provider's tools does not grant permission to reuse its confidential information. Any separate partner agreement also applies. Third-party providers are governed by their own agreements; this page states Rehost's duties and does not speak on their behalf.

Rehost does not take equity in client businesses as payment for its work. As of the date above, Rehost holds no equity ownership in other companies. The restrictions in this policy apply regardless of any financial interest.

5. Everyone handling information has duties

We require employees, officers, contractors, consultants, and other people acting for Rehost to follow these rules. Access must be limited to people who need the information for approved work and who are bound by appropriate confidentiality obligations.

Our Employee Confidentiality & Non-Disclosure Policy explains the duties our team follows when handling this information.

Service providers may process information only for an approved purpose under applicable agreements and access controls. Using Google Workspace, our CRM, the client portal, or another approved system does not permit personal use, unrelated reuse, or unauthorized sharing.

Confidential information must not be entered into personal accounts, unapproved AI tools, or other unapproved services. We must not authorize its use to train a general-purpose AI model or support another customer's work without express written permission.

6. Official channels and project records

Project instructions, decisions, approvals, files, and work-related communications must go through approved company channels. The client portal and connected CRM serve as the official project record. Relevant communication through approved company email or meetings must be saved or linked to that record.

For projects connected to GitHub, supported activity records can include code submissions, proposed changes, reviews, and merged changes, together with recorded times and links to the relevant repository. Work records should link those changes to the relevant request or ticket where supported.

Client access to project activity depends on the project's setup and permissions. Some security and engineering records are internal. These records do not establish a complete history of every code read, download, local copy, or destination to which information may have been copied.

7. Confidentiality also applies outside work hours

Team members may discuss general work challenges socially, such as saying that a bug has been difficult to fix. They must not reveal confidential client identities, statements, data, code, system details, workflows, or restricted project information to anyone who is not authorized to receive it.

Being off duty, working from another location, or speaking casually does not suspend these rules. Handwritten notes and other offline copies remain confidential and subject to the same restrictions, even when a system cannot track them.

Project decisions and instructions that arise outside an official channel must be recorded in the approved project system before they are acted on.

8. Safeguards and incident response

We must use reasonable safeguards, limit access, and protect credentials. Confidential information must not be published in a portfolio, case study, testimonial, or public example without the information owner's written permission.

Anyone acting for Rehost who discovers a suspected loss, unauthorized disclosure, or misuse must report it promptly through approved company channels. We must investigate, take reasonable steps to contain the issue, and notify the affected party as required by law and the applicable agreement.

Monitoring has limits. It cannot capture every offline action or private conversation. Those limits do not create permission to copy, disclose, or misuse information.

9. Exceptions and legally protected disclosures

Confidential information does not include information that can be shown to be public without a breach, already lawfully known without a duty of confidence, independently developed without using the confidential information, or lawfully received from another source without a confidentiality restriction.

Disclosure may be made with the information owner's written permission or when required by law. For a legally required disclosure, we must limit it to what is required and give advance notice when legally permitted.

This policy does not restrict legally protected reporting, cooperation with authorities, or employee rights. Under 18 U.S.C. § 1833(b), an individual may be immune from civil or criminal liability under federal or state trade secret law for a disclosure made in confidence to a government official or attorney solely to report or investigate a suspected legal violation, or made in a court filing under seal. In a retaliation lawsuit, the individual may disclose the trade secret to their attorney and use it in the case if filings containing it are made under seal and it is not otherwise disclosed except by court order. These protections also cover contractors and consultants where the statute applies.

10. When work ends

Ending a discussion, project, employment relationship, or contract does not itself authorize use or disclosure of confidential information. Duties continue for the period required by the applicable agreement and law. Trade secrets remain protected for as long as they qualify for that protection.

When requested or required by the applicable agreement, confidential information must be returned or deleted, subject to lawful retention requirements and protected backup copies. Retained copies remain subject to confidentiality and restricted-use duties.

11. California law and travel

To the extent legally permitted and consistent with the applicable signed agreement, this policy is governed by California law. Our confidentiality and restricted-use duties continue during travel and remote work, including work outside California or the United States.

A choice of California law does not remove mandatory laws or legal protections that apply where a person works or travels. Team members must follow applicable local law as well as their continuing obligations to Rehost and the information owner.

12. Agreements and questions

This page states Rehost's company-wide commitments. Every Rehost contract, statement of work, order form, NDA, employment agreement, partner agreement, or other agreement that links to or expressly references this policy incorporates these rules when that agreement is accepted. They apply to the discussions, information, services, and work covered by that agreement without requiring a separate NDA.

Outside parties accept these obligations through the linked agreement or another express acceptance of this policy. Visiting a subdomain or joining a meeting alone does not replace that acceptance.

We require appropriate confidentiality commitments from our team and approved providers. More specific terms in a signed agreement control if there is a conflict, subject to applicable law. A link to this policy does not reduce stronger confidentiality protections in that agreement.

For related policies, see our Privacy Policy, Terms of Service, and Acceptable Use Policy.

For confidentiality questions or concerns, contact [email protected].