How we protect your data
When you hire us to build software, we handle your business data, your source code, and often your customer information. Here's how we keep it safe.
Our approach
We treat every client engagement as if we're handling sensitive data, because we usually are. Access is limited to the people who need it. Everything is encrypted. We clean up after ourselves when the project ends.
Access controls
Only team members assigned to your project get access to your systems and data. Access is revoked when the project ends or when someone leaves the team. We use role-based permissions and audit logs.
Encryption
Data in transit uses TLS 1.3. Data at rest uses AES-256 encryption. We don't store credentials in plain text. API keys and secrets go in secure vaults, not in code repositories.
Development practices
Code reviews on every change. Automated security scanning in CI/CD pipelines. Dependencies are monitored for known vulnerabilities. We don't commit secrets to version control.
Handover and cleanup
When a project ends, we transfer everything to you and close our access. Source code, databases, hosting accounts, documentation. We don't keep copies. Your data leaves our systems.
Compliance readiness
We build systems with compliance requirements in mind. If you need HIPAA, SOC 2, or PCI-DSS compliance, we design for it from the start, not as an afterthought.
For healthcare clients, we sign BAAs, design with PHI protections, and follow minimum necessary standards.
Our practices align with SOC 2 trust principles. We can provide documentation for your audits.
For payment handling, we use tokenization and never store card data ourselves.
Security policies
Written procedures for detecting, containing, and reporting security incidents. We notify affected clients promptly.
Background checks for team members. Security training on onboarding. Clear policies on data handling.
Offices are locked and monitored. Workstations use full-disk encryption. No client data on personal devices.
We vet the tools we use. Cloud providers meet SOC 2 standards. We don't share your data with unnecessary third parties.
Questions
If you have specific security questions or need documentation for your compliance requirements, reach out. We're happy to walk through our practices.