WORKING WITH MOKUJIRO
Due Diligence & Working with Mokujiro
Everything your team may need to assess Mokujiro before engagement.
This page is for procurement, legal, security and finance teams. It sets out how Mokujiro is structured, how client material is handled, where AI and third-party tools are used, and what a contract with the studio normally covers. Anything not answered here can be provided during vendor onboarding.
Business information
Registered business name
Mokujiro Studio
Sole trader
45 606 524 102
Melbourne, Victoria, Australia
Victoria, Australia
hello@mokujiro.com
Not currently registered for GST. No GST is added to invoices.
Legal name
Available to procurement teams during onboarding
ABN status
Registration documents and any further business details can be provided during vendor onboarding.
Insurance
Mokujiro does not currently hold business insurance. Where a client requires professional indemnity, public liability or cyber cover for an engagement, it is arranged before work starts and a certificate of currency is provided.
Professional indemnity
Not currently held. Where a client requires it for an engagement, cover is arranged before work starts.
Public liability
Not currently held. Arranged before work starts where an engagement requires it.
Cyber liability
Not currently held. Arranged before work starts where an engagement requires it.
Certificate of currency
Provided to the client once cover is arranged for the engagement.
Capabilities
Mokujiro is a senior-led, independent product and experience design studio. Work is delivered directly by the founder.
UX strategy and design direction
Product and UX design for SaaS and enterprise software
UX research and expert review
AI experience design: workflows, agent interactions and generated output
Data visualisation
Design systems
Brand identity and websites, where they sit alongside product work
Supporting evidence: the case studies linked from each service page, and the studio's own products on the Framer Marketplace (MokuDocs, MokuGraph, MokuToc).
Security and confidentiality
Mokujiro follows practical security and data minimisation practices appropriate for an independent design studio. There is no certification such as ISO 27001 or SOC 2, and no dedicated security team. What is in place:
Access to client material is limited to what the project needs. As a single-person studio, that access is the founder’s alone.
Work is done on encrypted devices protected by password and biometric lock.
Operating systems and software are kept current.
Accounts use a password manager and multi-factor authentication.
Client material is stored in Microsoft OneDrive with version history and recovery features enabled, and is not shared beyond the engagement.
NDAs are supported, on the client’s template or Mokujiro’s.
Client-specific security requirements are reviewed before work starts and written into the engagement where agreed.
Subcontractors and access
Mokujiro does not use subcontractors as standard. All design, research and delivery work is done by the founder.
If a specialist is ever needed for part of an engagement, the client is told which work is involved and approves it in writing before any material is shared.
Anyone approved this way is bound by confidentiality and security obligations equivalent to those in the client agreement.
Unless a subcontractor has been approved in this way, access to client material is the founder’s alone.
Security incident response
If a security incident affects client material, the response follows a set sequence:
Contain
The affected accounts and devices are isolated and credentials are rotated as soon as the incident is identified.
Notify
The affected client is informed by email within 48 hours of the incident being identified, with what is known at that point and what is being done.
Investigate
The cause and the scope of the incident are established and documented.
Remediate
The weakness is fixed, and the client receives a written summary of what happened and what changed.
Legal obligations
Where the Notifiable Data Breaches scheme or a client’s own notification requirements apply, notifications are made within the required timeframes.
Contact
AI and third-party tools
Mokujiro uses professional third-party services as part of delivery, including design tools, cloud storage and AI assistants (currently Claude, ChatGPT, and the AI features built into Figma and Framer). How AI use is handled:
Whether and how AI tools are used is decided per project, based on the confidentiality of the material.
Sensitive client information is not put into third-party AI systems unless the client has agreed to it.
AI use can be restricted or switched off entirely where a client’s policy requires it.
Project-specific requirements for AI and tooling are agreed before the engagement starts.
Data residency or platform restrictions can be reviewed during onboarding.
The studio also runs its own experiments with local, offline AI models. These are published in the Lab and are not used on client work.
Third-party service providers
What each provider is used for, which client data it can touch, where that data sits, and whether it can be taken out of an engagement.
Framer
Website design, build and hosting. Client data: website content and Framer project files. Location: Framer’s infrastructure in the United States and Europe. Cannot be disabled for a Framer build. Privacy statement ↗
Figma
Design files and prototypes. Client data: design material and copy. Location: United States. Can be replaced by working inside the client’s own Figma workspace. Privacy policy ↗
Microsoft OneDrive
Working storage with version history. Client data: all project material. Location: the region assigned to the account by Microsoft, confirmed on request. Can be replaced by client-provided storage. Privacy statement ↗
Claude (Anthropic)
AI assistant for drafting, research and code. Client data: only material the client has approved for AI use. Can be switched off for an engagement. Privacy policy ↗
ChatGPT (OpenAI)
AI assistant for drafting and research. Client data: only material the client has approved for AI use. Can be switched off for an engagement. Privacy policy ↗
AI features in Figma and Framer
Built into the design tools. Used under the same rules as the AI assistants above, and switched off where a client’s policy requires it.
Data handling
Only the project information needed to do the work is requested.
Access is limited to the founder, and to any subcontractor the client has approved in writing.
Material is handled according to the requirements agreed for the project.
Project material is retained for 12 months after final delivery and then deleted, unless a different retention or deletion period is agreed with the client.
Where data is stored and which third-party tools touch it can be reviewed before work starts.
Clients can ask for material to be deleted earlier than the standard period at any time.
Project material is returned or exported to the client on request at the end of an engagement.
Deletion covers working copies and OneDrive version history, and is confirmed in writing when a client asks for it.
Privacy
Policy
Personal information is handled according to the published Privacy Policy ↗
Enquiries
Client obligations
Client-specific privacy obligations can be written into the engagement agreement.
IP and ownership
Final deliverables
Ownership of the agreed deliverables transfers to the client on final payment.
Source files
Working files (Figma, Framer project files and equivalent) are included in the handover.
Pre-existing Mokujiro IP
Components, templates, tooling and methods developed before or outside the engagement remain Mokujiro’s, and are licensed to the client for use within the deliverables.
Third-party licensed assets
Fonts, imagery and libraries stay subject to their own licences. Paid licences are taken out in the client’s name.
Confidential client material
Remains the client’s and is used only for the engagement.
Commercial and legal
Engagement model
Fixed-scope projects. Ongoing or embedded support is available by proposal.
Scope
Agreed in writing before work starts. Changes to scope are quoted separately before the work is done.
Pricing
Quoted per engagement in USD. No GST is added, as Mokujiro is not currently GST registered. Starting prices are published on each service page.
Payment terms
50% deposit to commence, balance on final delivery.
Invoicing
Invoices are due within 14 days of issue.
Contracting
Mokujiro’s engagement letter, or the client’s agreement where preferred, subject to review.
Termination
Either party may end the engagement in writing. Work completed to that point is invoiced; the deposit is not refunded.
Ownership transfer
On final payment, as above.
Governing law
Victoria, Australia, under Mokujiro’s standard engagement letter.
Detailed terms are in the engagement agreement rather than on this page.
Business continuity
Mokujiro is a single-person studio, and engagements are run so that a client is never dependent on one machine or one inbox:
Work in progress is shared at agreed milestones, and design files live in the client’s own Figma or Framer workspace where the client prefers.
Source files and deliverables are handed over at each milestone, not only at the end.
Planned absences are communicated in advance with dates and a handover note. In an unplanned absence the client already holds the current files, and the engagement can be paused or ended under the agreement.
Vendor onboarding
Mokujiro can support:
Procurement and supplier questionnaires
Vendor registration
Security questionnaires
NDA processes
Finance onboarding
Additional business documentation
Client-specific compliance requirements, where reasonable for a studio of this size