Our practices
Six commitments behind every engagement.
Secure development lifecycle
Security is part of every change, not a review at the end.
- Peer code review on every pull request
- Dependency, secret and container scanning in CI
- OWASP-informed design for web and API work
- Least-privilege access to repositories and environments
Data protection
We handle your data as if a regulator were watching.
- Data minimisation in design and testing
- Encryption in transit and at rest by default
- Production data stays in environments you control
- Synthetic or masked data for development where possible
Confidentiality and IP
Your ideas and code stay yours.
- NDA available before you share details
- Code, infrastructure and documentation assigned to you as agreed
- No reuse of client-specific code in other projects
- Access removed at the end of an engagement
Responsible AI
AI features ship with measurement, oversight and an audit trail.
- Evaluation sets before and after every change
- Human approval for consequential actions
- Provider settings that exclude your data from model training where available
- Logging and documentation your governance team can review
Quality and reliability
Software that keeps working after launch day.
- Automated tests and CI/CD from the first release
- Monitoring, alerting and rehearsed rollbacks
- Accessibility tested toward WCAG 2.2 AA
- Performance budgets for user-facing products
Continuity and no lock-in
You can always take the work in-house.
- Readable code and architecture decision records
- Runbooks and handover sessions
- Open standards and portable infrastructure as code
- Documented dependencies and licences
AI in our own work
How we use AI when we build for you.
AI tools make our engineers faster. These rules keep your code, your data and your quality bar safe while we use them.
- We use AI coding and review tools to move faster, and every change is reviewed by an engineer.
- Your code and data only go to AI tools you have approved, under settings that exclude training where available.
- We tell you where AI was used in your project if your policies require it.
Compliance support
Requirements we help you meet.
GDPR and data privacy
Privacy-by-design patterns, data maps and retention rules built into the software.
EU AI Act readiness
Risk classification input, technical documentation, logging and human oversight for AI features.
SOC 2 and ISO 27001 evidence
Access control, change management and monitoring that produce evidence for your audits.
PCI DSS scope reduction
Payment flows that keep card data with licensed providers, so less of your system is in scope.
Accessibility
Interfaces designed and tested toward WCAG 2.2 AA and the European Accessibility Act.
We help you meet these requirements through how we design and build. We do not claim certifications of our own, and formal compliance decisions remain with your auditors and legal advisers.
FAQ
Security questions, answered plainly.
Do you hold SOC 2 or ISO 27001 certification?
No, and we do not claim to. We follow practices aligned with those frameworks and build systems that produce the evidence your own audits need.
Where will our data be stored?
In environments you own or approve, in the regions you choose. We avoid copying production data into our own systems.
Can you work inside our cloud accounts and tools?
Yes. Many clients prefer that we work in their repositories, cloud accounts and ticketing, with access they grant and can revoke at any time.
How do you handle a security issue we report?
We acknowledge it, assess severity with you, fix and verify it, and document the root cause and any preventive changes.
Need our answers for your vendor review?
Send your security questionnaire or NDA through the contact form and we will respond in writing.