Company
Security & Quality Practices
How we scope, build, test and support the software we deliver. This page describes working practices. It is not a certification or a compliance attestation.
Practices
Scope
Written scope and acceptance criteria
Requirements, user roles, integrations, data migration, hosting and acceptance criteria are agreed in writing before a project is priced.
Acceptance
Testing against acceptance criteria
Deliverables are tested against the written acceptance criteria in your proposal, and milestone payments follow your acceptance.
Access
Role-based access
Business systems we build include user roles and permissions, scoped in your proposal.
Secrets
Credentials kept server-side
API keys and database credentials stay in server-side configuration, never in browser code or in the repository.
Maintenance
Updates, backups and monitoring
Support and maintenance plans cover dependency updates, backups and basic monitoring within the agreed hours.
Handover
Documented handover
At handover you receive the source code, access to your accounts and the documentation agreed in the proposal.
Security services
What our security services are, and are not
Our cybersecurity packages cover configuration reviews, website hardening, deployment audits and ongoing maintenance.
- Not included: Configuration reviews and website hardening improve a baseline; they are not penetration tests.
- Not included: We do not provide compliance certification or incident-response retainers as part of these services.
- Not included: No service can guarantee protection against breaches.
- Not included: Formal compliance work, penetration testing and incident response are scoped separately, only where the right expertise and authorisation are in place.
Need a specific standard?
If your project must meet a specific framework or regulation (for example ISO 27001, SOC 2, HIPAA or UK GDPR documentation), tell us during discovery. We will confirm what we can provide and what would need a specialist partner, before you commit.
Discuss your security requirements
Share your requirements and we will include them in the written scope.