Encrypted transport
All traffic is served over TLS with modern ciphers and HSTS. Internal service-to-service calls stay on private networks rather than traversing the public internet.
Security
The engineering practices we actually apply. No certifications we do not hold.
What we apply
Least-privilege access
Access is granted per person and per environment, with production separated from everything else. Access is reviewed when a project ends and revoked when someone leaves it.
Secret management
Credentials are held in a secret store or environment configuration, never in the repository or a container image. Rotation procedures are documented per deployment and rehearsed rather than assumed.
Logging without personal data
Application and access logs are retained for diagnosis and audit. Personal data is excluded from production logs by design, so a log export is not a data breach.
Code review and automated checks
Every change is reviewed by another engineer. Linting, type checking, unit tests, end-to-end tests and accessibility checks run automatically before anything reaches production.
Dependency hygiene
Dependencies are pinned with a committed lockfile, updated deliberately, and monitored for published advisories. Base images are rebuilt regularly rather than pinned and forgotten.
Backups and recovery
Data and configuration are backed up on a schedule appropriate to the system. Restores are tested — an untested backup is a belief, not a control.
Human approval for consequential AI actions
AI systems operate within a written boundary. Actions with financial, contractual or legal consequence require explicit human approval, and every automated action is logged with the reasoning behind it.
What we do not claim
We do not hold SOC 2, ISO 27001 or any comparable certification, and we do not claim to. The practices above are what we actually do. If your procurement process requires a formal attestation, tell us early — it changes what we can commit to, and we would rather say so before a contract than during one.