How we protect the systems we build.

Secure development lifecycle

• Threat modelling at design time for any feature touching client data, payments, or authentication.
• Dependency scanning and static analysis run automatically on every change, gating deployment rather than merely reporting.
• Independent review required for changes to authentication, authorisation, payment handling, or data export.
• Secrets never committed to source control; managed through a dedicated secrets manager.

Identity and access

• Role-based access control with a small, clearly defined set of roles rather than ad hoc permissions.
• Multi-factor authentication required without exception for every internal and subcontractor account.
• Short-lived access tokens with refresh rotation, and immediate revocation on any compromise signal.
• Each backend service authenticates with its own scoped credential, never a shared administrative key.

Data protection

• TLS 1.2 or higher enforced on every endpoint, internal and external, with no plaintext fallback.
• Encryption at rest across all database and file storage, with field-level encryption on the most sensitive data.
• Encryption keys held in a dedicated key-management service, separate from the application database, and rotated on schedule.
• Tenant isolation enforced at the database layer through row-level security, not only in application code.

Infrastructure

• Network segmentation between public web, application, and database tiers, with minimal explicit firewall rules between them.
• A web application firewall in front of all public-facing services.
• Hardened containers: minimal base images, no root execution, regular rebuilds for upstream patches.
• Automated encrypted backups with a tested restore procedure, not an untested backup job.

Monitoring and incident response

• Centralised logging across application, access, and infrastructure layers.
• A tamper-evident audit trail for privileged actions, held separately from general application logs.
• Automated alerting on anomalous patterns such as repeated failed logins or unusual data export volume.
• A documented, rehearsed incident response procedure covering detection, containment, client notification, and post-incident review.

Compliance

Stated precisely, including what we do not hold. A vendor who is vague here is a risk to your own compliance position.

Reporting a vulnerability

If you have found a security issue in a system we built or operate, email us and we will respond within 24 hours. We do not pursue researchers acting in good faith.