Security

How we handle what you trust us with

No badges, no vague assurances. The practices below are how we work today, written for the person whose job is to check.

Access is scoped and revocable

Client infrastructure stays in accounts the client owns; we operate inside them with scoped credentials
Access is granted per engagement and removed when it ends; revoking us costs you nothing
Credentials are stored in a password manager, never in repositories or chat

Infrastructure is hardened by default

OS hardening, automatic security patching, and firewall baselines on every server we manage
TLS everywhere; keys and secrets kept out of code and version control
Public exposure limited to what the workload requires

Backups exist to be restored

Encrypted backups, stored separately from the systems they protect
Recovery objectives (RPO/RTO) agreed in writing per engagement
Restore tests on a schedule, because a backup that has never been restored doesn’t count

Incidents are communicated, not managed away

Monitoring with human escalation for managed clients
A dedicated incident channel with live updates while we work
A written post-incident summary: what happened, why, and what changed

Data handling follows the engagement

Client data is used only for the work it was shared for
Data-processing terms are part of the signed agreement where required
This website itself sets no cookies and runs no third-party trackers

What we don’t have yet

We hold no formal certifications (SOC 2, ISO 27001) at this stage. If your procurement process requires specific controls or documentation, tell us what you need - questionnaires get answered directly by the engineers who run the systems, at [email protected].

Bring your security questionnaire

The fastest way to assess us is to ask directly - an engineer answers, in writing.

Book a call Tell us about your project

Prefer email? Write to [email protected]