Security

Encryption

All traffic to our website and applications is served over TLS. Data stored in our managed databases and object storage is encrypted at rest.

Access control

Access to production data follows least privilege.

• Individual named accounts — no shared logins.
• Role-based permissions enforced at the database layer with row-level security.
• Administrative views require both authentication and an explicit admin role grant.
• Access reviewed when roles change and revoked immediately on departure.

Secure development

Every change is reviewed before it reaches production.

• Peer review on all code changes.
• Server-side validation on every input, not just in the browser.
• Secrets held in a managed secret store, never in source code.
• Dependency scanning for known vulnerabilities.

Infrastructure

We run on hardened, managed cloud infrastructure with isolated environments for development, staging and production. Infrastructure changes are versioned and reversible.

Monitoring and response

Application and infrastructure logs are collected centrally with alerting on anomalies. We maintain an incident response process covering triage, containment, client notification and post-incident review.

Backups and continuity

Production databases are backed up on an automated schedule with point-in-time recovery. Restores are tested so that recovery targets are realistic rather than theoretical.

Responsible disclosure

If you believe you have found a vulnerability, email us with details and steps to reproduce. We will acknowledge within two business days and keep you updated. Please do not access or modify other people's data while testing.

Client commitments

For contracted engagements we can support security questionnaires, data processing agreements, penetration test coordination and compliance-driven architecture requirements.