Application security
- Server-side authorisation
- Role and tenant boundaries
- Input validation and secure session design
- Dependency maintenance
- Protection against common web vulnerabilities
Security & reliability
Security considered at every layer.
Secure software is the result of many deliberate decisions: who can access data, where secrets are stored, how changes are released, what happens when a provider fails and how unusual activity becomes visible.
What this page is — and is not
This page describes our general engineering approach. Specific controls depend on the agreed project, architecture, hosting arrangement and service scope. It is not a claim of independent certification.
Data protection
- Data minimisation
- Encryption in transit
- Appropriate encryption at rest through hosting providers
- Controlled access and retention considerations
- Redacted logs
Infrastructure and deployment
- Separate environments
- Protected configuration
- Staged releases and monitoring
- Backups
- Rollback-aware deployment
Third-party services
- Provider assessment
- Least-privilege credentials
- Webhook verification
- Rate-limit handling
- Provider failure states
Ongoing maintenance
- Security updates
- Dependency review
- Incident investigation
- Audit trails where appropriate
- Improvement after findings
Visibility and monitoring
- Health and error monitoring
- Alerting on unusual activity
- Actionable, redacted logging
- Clear operational runbooks
Responsible disclosure
Found a security concern?
We welcome responsible disclosure. Please submit security concerns through our contact form and select “Security disclosure”, so it reaches the right place quickly.
Please do not include
- Passwords
- Private keys
- Payment-card details
- Production credentials
- Unnecessary personal information