Security
Security is a design requirement, not a final checklist
The systems we build hold payroll, financial records and personal data. Here is how we protect them — and where the limits are.
Practices
What we do on every project
The exact controls depend on each system's risks and hosting environment, and are agreed during design.
Secure development lifecycle
- Threat modelling for systems that handle personal or financial data
- Peer code review before changes are merged
- Automated tests, dependency vulnerability scanning and secret scanning in CI
- Input validation and parameterised database queries by default
Access control
- Role-based permissions designed around least privilege
- Multi-factor authentication for administrative access where the platform supports it
- Separate accounts per person — no shared administrator logins
- Access reviewed and revoked when people change roles or leave
Data protection
- Encryption in transit (TLS) for all connections we deploy
- Collect only the personal data a feature needs, with defined retention
- Audit logs for sensitive records and administrative actions
- Production data kept out of development and test environments
Infrastructure & operations
- Databases and management interfaces kept off the public internet
- Secrets stored in protected secret stores, never in source code
- Regular patching of operating systems, runtimes and dependencies
- Backups with documented and periodically tested restore procedures
Being straight with you
What we will not claim
- No security control or review can guarantee a system is free of vulnerabilities.
- We describe the scope of every review and what it did not cover.
- We only claim certifications, audits or compliance that have been independently verified, and will share evidence on request.
- Security is shared: hosting providers, clients and users each control part of the risk.
Reporting a vulnerability
If you believe you have found a security vulnerability in this website or in a system we operate, please email security@example.com with a description, the steps to reproduce it and any relevant details. Please do not access data that is not yours, degrade services or publicly disclose the issue before we have had a reasonable opportunity to address it.
We will acknowledge reports, keep you informed of progress and credit you if you wish. Machine-readable contact details are published at /.well-known/security.txt.
Need a security review of an existing system?
Tell us what the system does and what worries you. We will propose a scope that fits the risk.