Security
Money, data, permissions.
Two of the systems behind this site handled payments, contracts and company records. That is where these practices come from — not from a policy document written for a website.
Permissions
Rights per action, enforced server-side
In the ERP, every operation in every module is a separate right: booking stock, releasing a payment and viewing margins are three different permissions. The rule is simple — the browser may hide a button, but the server decides.
Validation
Layers, not one hopeful check
Input is validated at the edge, again in the business rules, and constrained in the database. On the auction platform an invalid bid was not a cosmetic bug — it was a dispute between two parties with a contract between them.
Payments
Money moves through the provider
Card data belongs with the payment provider, not in your database. What we build is the part around it: idempotent operations, reconciliation, and an audit trail that can answer what happened months later.
Data
Collect less, keep it shorter
Personal data is collected where it is needed and kept for as long as it is needed. This site is the same: no analytics, no trackers, no cookies — the contact form collects what an invoice requires and nothing beyond it.
Access
Least privilege, and an exit
We ask for the narrowest access that lets the work happen, prefer named accounts over shared credentials, and expect them revoked when the project ends. Handover includes a list of every access to close.
Confidentiality
NDA as the default
Client names are not published — which is why the case studies on this site are anonymous. If you want the same protection, you already have it.
What we don't claim
There is no ISO 27001 or SOC 2 certification here, and this page will not imply one. Certification is verifiable, so claiming it falsely costs more than it could ever win. What is described above is practice, and you are welcome to test it during the first phase of any project.
Have a security review coming up?
Ask the awkward questions early — we prefer them early too.