Enterprise / Procurement & assurance

Information for your vendor review

Business, technical and security facts for procurement review, clearly separating inspectable website evidence from owner-reported details and documents requiring independent verification.

Request procurement information Capability statement

Procurement and technical assurance checklist

This page separates published technical evidence from supporting business documents. Insurance, signed terms, customer references and security questionnaires are handled through approved procurement channels rather than inferred from website copy.

Santa Clara DBA; renewal around 2022 reported

Company and contracting identity

The owner reports the original Santa Clara County DBA filing in 2013 and a renewal approximately four years ago (around 2022). County FBN statements generally expire five years after filing; renewal documentation and current registration dates have not been independently reviewed. The underlying legal registrant, business address and authorized signer still need confirmation.

Scoped per engagement

Commercial scope and pricing

Market benchmarks inform scoping internally, but Demonic Binary does not publish a binding company rate card. Contact us for a tailored written project quote; fees, milestones and support obligations require a signed agreement.

Flexible delivery capacity; confirmed per project

Delivery owner and specialist capacity

Demonic Binary is founder-led, supported by employees and independent contractors. We accommodate parallel engagements by aligning the team to project scope and actual availability. Staffing, specialist participation, deadlines and support coverage are confirmed before accepting each project; no unlimited-capacity promise.

Limited public evidence

Technical work and references

First-party site operations, an internal monitoring demonstration and an experience-based mobile/backend overview are labeled separately. No named, client-approved references or external outcome metrics are published.

Owner-confirmed security practices; evidence review

Information security and privacy

The business owner reports that workforce MFA, device protection, access lifecycle, backups and incident response are covered. Website release safeguards are independently inspectable in the published code and tests. Company-wide implementation evidence and policy adoption have not yet been reviewed for an enterprise questionnaire; no certification is implied.

Draft templates; execution and controls pending

Confidentiality and data processing

Draft NDA, MSA, SOW, DPA and security/retention/incident templates exist, but are not signed, adopted or proof of implemented controls. Client-specific terms, subprocessors, secure transfer and data handling require legal and technical verification before sensitive work.

Insurance owner-reported; documents pending

Insurance, financial and vendor paperwork

The owner reports the business has insurance. Coverage type, insurer, limits, effective dates and any certificate of insurance are not yet verified; proof can be discussed during vendor due diligence through a suitable private channel. Tax and banking data are never requested via public intake.

Opportunity-dependent

Government and defense eligibility

Federal registrations, UEI/CAGE details, clearances, controlled-information handling, export eligibility and contract qualifications are not asserted without verification for the particular opportunity.

Company profile and verification status

The business owner supplied the profile below. County filing status, insurance evidence and independent security reviews require current source documents before an external reviewer can rely on them.

Operating name: Demonic Binary — Doing Business As (DBA) / fictitious business name
DBA original filing: Santa Clara County, 2013 (owner-reported)
DBA last renewal reported: Approximately 2022 (owner-reported in November 2026; exact filing date not provided)
DBA renewal status: Owner reports renewal about 2022. A five-year cycle would ordinarily extend into about 2027; exact date, any subsequent changes and current county record still need verification
Business base: Santa Clara County, California, United States
Delivery: Worldwide remote, hybrid and on-site by agreement
Team: Founder-led, with employees and independent contractors
Capacity: Scalable project delivery through employees and contractors; engagement volume, specialist coverage and schedule are agreed after evaluating actual availability
Indicative pricing: Nonbinding market-informed budget examples; request a tailored quote after technical discovery, with final terms in an approved SOW
Insurance: Owner confirms some business insurance; coverage type, carrier, limits and current policy dates await documentation
Company security: Owner reports identity/MFA, device security, access controls, backups and incident response are in place; scope and operating evidence not independently reviewed

Website engineering controls we can substantiate

These safeguards have evidence in the website implementation and release workflow. These independently inspectable website examples are distinct from the broader employee, contractor and business security practices reported by the owner.

Build and quality gates

TypeScript checking, automated tests, production builds and public-route validation run for website releases.

Boundary: Applies to the website release scope, not a certification or an audit of client work.

Code and dependency checks

GitGuardian and Snyk PR checks and production-scoped dependency audit results have been verified on releases.

Boundary: Wider GitHub Dependabot findings need separate triage; the scoped audit does not cover every dependency.

Cloudflare edge safeguards

The published Worker includes request rate-limit bindings for public and restricted endpoints.

Boundary: Rate limiting alone does not establish complete application security or operational monitoring.

Backend authorization test coverage

Test suites validate authorization, tenant isolation and approval semantics in local test environments.

Boundary: Tests do not establish that optional D1 databases, private portals or operator integrations are active in production.

Fail-closed optional integrations

Protected endpoints reject requests if required provider or identity configuration is unavailable.

Boundary: Real provider credentials, access controls, incident routing and operators must be validated before activation.

Owner-confirmed security practices — evidence to review

The business owner confirms the company covers identity, MFA, devices, access administration, backups and incident response. Enterprise buyers may request current, appropriately redacted evidence of the scope, operating effectiveness and policy adoption. This is not an external audit or certification claim.

MFA enrollment and access policy scope across employee, contractor and privileged accounts
Device inventory, disk-encryption and patch-report evidence for covered equipment
Joiner/mover/leaver access approvals, periodic reviews and removal records
Client-data inventory, authorized processors, retention rules and deletion evidence
Backup scope, restoration tests and documented recovery objectives
Incident-response ownership, actual communication routes and exercise records
Adopted policy revisions, staff/contractor acknowledgements and training evidence

Procurement terminology, explained

Legal entity versus trading name

Demonic Binary is the owner-reported DBA (fictitious business name), not necessarily the legal name on a contract or W-9. A DBA does not establish an LLC or corporation. The underlying registrant, current Santa Clara County renewal and authorized signer must still be verified. The owner reports the original filing year was 2013 and a renewal around 2022. County FBN statements generally expire after five years. The exact renewal date and any changes to registered facts require review before we describe the registration as verified.

Santa Clara County Clerk-Recorder: FBN filing and renewal guidance

W-9, tax identity and vendor payments

U.S. clients often need a Form W-9 to identify the payee for tax reporting. It can contain sensitive taxpayer information and must be handled through an appropriate verified channel, not uploaded to the public repository or intake form.

IRS Form W-9 information

Insurance and liability

Some clients require proof of active general liability, professional errors-and-omissions, cyber coverage or workers' compensation, depending on the engagement. Coverage and amounts must come from actual policy documents. The owner confirms the business has insurance; policy types and limits must be verified during vendor review.

Government vendor eligibility

Registration identifiers, solicitations, subcontract flow-downs and security requirements are separate from engineering capability. No SAM/UEI/CAGE identifiers, clearances or federal contracting approval are claimed without current evidence.

Review public-sector opportunity boundaries

What a buyer can inspect today

Evidence-labeled engineering work

Three first-party, internal or experience-based records, each with scope and limitations.

Review public material

Authorized assessment methodology

How written authorization, review findings, risk and remediation are framed.

Review public material

Engineering delivery practices

Release and operational controls, separating implemented tooling from inactive features.

Review public material

For NDA, data-processing, tax, insurance, contract or account paperwork, coordinate a verified contact and approved secure transfer method first. Never send banking details, secrets, controlled government data or private source code through the public intake form.

Review document readiness Start vendor inquiry Book a technical discovery call