Every decision we make in technology traces back to a simple conviction: the products we ship should be trustworthy, durable, and fast — long after the first version launches. Here is how we think about building.
Talk to our team →We reach for technologies that have earned trust at scale — not the most exciting option, but the most reliable one.
Encryption, access control, and key management are architectural decisions, not features bolted on after launch.
We apply AI where it genuinely improves the experience — not as a trend, but as a considered capability at each product layer.
We collect only what we need, store only what we must, and build systems that respect users rather than exploit them.
"The best technology is the kind
you never have to think about —
it simply works, quietly, every time."
— Engineering philosophy at Perch Works
Every product we build rests on a layered architecture — each tier chosen for reliability and maintained with the same care as the user-facing surface above it.
No layer is an afterthought. From the edge that delivers content to the key management system that protects your data, each piece is deliberate and independently verifiable.
Ask us anything →Not rules. Convictions. Every technology choice at Perch Works traces back to at least one of these.
We don't over-engineer for scale we don't yet have. We build appropriately for today, with architecture that makes tomorrow's growth straightforward — not a rewrite.
Intelligence is woven into our products at the infrastructure layer — not bolted on top as a chatbot. It surfaces where it genuinely helps and stays invisible everywhere else.
Our users live on their phones. We build for mobile first — with native platform APIs, share-sheet integration, and performance targets that match device constraints.
Every product ships with end-to-end encryption, hardware-backed key management, and access controls designed at architecture time. Never as a sprint item before launch.
Monitoring, structured logging, and alerting are configured before a product goes live. We don't discover problems from user reports — we see them first.
We collect only what is necessary. Data that isn't collected can't be leaked, sold, or misused. Restraint in data collection is itself a security and privacy feature.
Our products handle data that people genuinely care about — delivery addresses, orders, and saved knowledge. We treat that responsibility with absolute seriousness.
Encryption keys are managed using industry-leading hardware security infrastructure — they never appear in application code. Data is encrypted before it leaves a device and decrypted only on authorised devices belonging to the account holder or explicitly invited circle members.
Every access event is logged, auditable, and monitored. Unusual patterns trigger automated alerts before they become incidents. We hold ourselves to standards consistent with what the best engineering organisations in the world apply to sensitive consumer data.
Security questions? Talk to us →All stored files, documents, and sensitive fields encrypted with industry-standard AES-256 using hardware-backed key management.
All API communication and file transfers use modern TLS. No unencrypted data ever leaves a device or crosses our network.
Encryption keys are managed by hardware security modules with independently auditable logs. Application code never has access to raw keys.
Signed tokens with short expiry and automatic rotation. A compromised token becomes invalid within minutes, not days.
Every API call and data access is logged with structured, immutable audit records — for full visibility and incident response capability.
We have no advertising model. Your data is never sold, shared, or analysed for commercial purposes outside of operating our products.
We use modern AI and machine learning capabilities selectively — in the specific surfaces where they produce genuine, measurable improvements to the user experience.
Across our products, AI powers intelligent scheduling, wellbeing signal interpretation, cross-source summarisation, and semantic knowledge retrieval. In every case, AI runs at the infrastructure layer — not as a feature you see, but as capability you feel.
We do not send personal content or identifiable user data to external AI services without explicit, informed consent. Where AI processing is required, it is anonymised, scoped, and governed by the same data minimisation principles that apply to the rest of our infrastructure.
Ask about our AI approach →These are not marketing statements. They describe specific, verifiable properties of how our systems are built and operated today.
We operate on cloud infrastructure used by the world's most demanding enterprises — with the same reliability, redundancy, and compliance posture they require.
Our security practices are aligned with internationally recognised standards for information security management, encryption, and data handling.
User data is stored in cloud regions appropriate to the geography of our users — with a strong preference for keeping data close to where it is created.
We set and track internal performance targets for API response times, app startup, and AI processing — under realistic load, not benchmarks.
Our deployment pipeline is automated, tested, and able to ship improvements multiple times a week — without downtime and with full rollback capability.
When you delete your account or individual data, it is removed from live systems within 30 days and from backups within 90. Permanently. Not archived.
We're open to conversations with engineers, partners, and teams who share our conviction that the best technology is the kind that earns trust quietly, over time.