Security & Confidentiality

What This Page Is

This page documents the security and confidentiality practices we actually follow. We do not currently hold ISO 27001 or SOC 2 certifications, and we would rather show you what we really do than publish claims we cannot back. Where a client engagement requires specific certifications or controls, those are confirmed and agreed before work begins.

Confidentiality

  • We routinely work under NDA, and are comfortable signing client-provided agreements before any detailed discussion.
  • Client information is shared only with team members directly involved in the engagement.
  • When publication is not permitted, we use anonymized case studies — several systems described on this site are published without client-identifying detail for this reason.

Application Security Practices

The business systems we build routinely handle sensitive operational data. Standard practices applied across our projects:

  • Role-based access control — users see only the functions and data their role permits.
  • Session security — authenticated sessions with appropriate expiry and re-verification for sensitive actions.
  • Audit logging — actions are recorded with who, what, and when; in regulated contexts, records include revision history and tamper-evident trails.
  • Electronic records & signatures — where required, controls aligned with FDA 21 CFR Part 11, including cryptographic signatures on generated documents (as implemented for a pharmaceutical quality management system).

Data Handling & Infrastructure

  • Deployment models are agreed per engagement: client-managed servers, our managed hosting, or cloud environments in the client’s preferred region.
  • Data backup arrangements are defined and documented per system.
  • Access to production environments is limited to assigned engineers and revoked when no longer needed.
  • Client data is not used for any purpose other than the engagement it belongs to.

Development Practices

  • Changes are tracked in version control from requirements through deployment.
  • Functionality, performance, and security testing are performed throughout development, not only at the end.
  • There is no direct-to-production workflow: releases go through review and verification.

What We Ask Of You

Security is mutual. For engagements involving your infrastructure or accounts, we ask for scoped credentials, defined access windows, and a named contact for security questions — and we provide the same on our side.