Security practices
The baseline every project gets, whether or not security is in its title. Secrets, access, data, dependencies, logging, and what we tell you when something goes wrong.
Baseline on every project
- Secrets never travel in chat, email or documents. They are entered directly into the hosting account's secret store by whoever owns the account. We do not ask you to paste a key into a message, and we will not paste one to you.
- Least privilege. Every service account and API token gets the smallest scope that works, and its own identity, so it can be revoked alone.
- Authentication we did not invent. Standard libraries, modern hashing, short-lived sessions, optional single sign-on. No home-made crypto.
- Encryption in transit everywhere and at rest for stored data and backups.
- Dependencies pinned and scanned. Updates applied on a schedule, not when something breaks.
- Headers and policies set strictly by default: content security policy, frame protection, referrer policy, cookie flags.
- No stack traces, no internal names on screen. Users see plain words; engineers see the detail in the logs.
- Logs without secrets or personal data where avoidable, retained for a defined period, in the account you own.
Access to your systems
We ask for the minimum we need, for the time we need it, through named accounts rather than shared ones. When the project ends, access is removed or reduced to what support needs, and we confirm it in writing.
Personal data
For systems that process personal data we build in what GDPR expects: a record of what is stored and why, retention periods that are enforced by code, the ability to export and delete a person's data, and a data processing agreement if we act as a processor. We do not use your data to train or test anything outside the project.
AI-specific
Model providers are configured so your data is not used for training. Prompts and outputs are logged in your account where regulation needs an audit trail, and not at all where it does not. Retrieval respects the permissions of the person asking. Inputs are treated as untrusted; see AI integration patterns.
If something goes wrong
We tell you. Fast, in plain language, with what we know, what we do not, and what we are doing. You hear about an incident from us, not from your customers. After it is resolved you get a short write-up of cause and fix.
What this is not
This is the baseline. Systems with elevated risk get a threat model, formal reviews and more; see High-security systems. We are engineers, not auditors; for certifications we work alongside your auditor.