Security built in from the first release.
The systems we build handle operational, personal and sensitive data. This page describes how we protect client systems and data in the way we design, build and run software.
How we protect your data.
Enterprise sign-in and multi-factor access
People sign in through their organization's enterprise SSO, with multi-factor access where the product requires it.
Data isolated per client
Each client's data is kept separate, including at the database level, so one client never reaches another's records.
Per-client encryption keys
Where the product needs it, each client has its own encryption keys for sensitive information.
Audit trails and immutable records
Relevant actions are logged, and official records are versioned and kept immutable instead of being overwritten.
Least-privilege access
Access to client environments is limited to the people and permissions each task requires.
Privacy by design
Consent, retention rules, anonymization and data-subject requests are designed into the product, not added later.
Typed contracts and testing
API contracts are typed and checked, and automated tests run before every release.
Infrastructure as code
Environments are defined in code, so they are reproducible, reviewable and consistent from staging to production.
Working with your team
We can sign a non-disclosure agreement before you share anything sensitive. Ask for it when you first contact us.
- Access to your systems is granted per project, with only the permissions the work needs.
- Access is removed when the project ends.
Report a vulnerability
If you believe you have found a security issue in a system we built, email [email protected] with the subject “Security”.
Describe what you found and how to reproduce it. Please do not access data that is not yours or disrupt the service while investigating.
This page describes our engineering practices. It is not a certification; the terms of each project are agreed in its contract.