Secure by pipeline, not by promise.
Security that depends on someone remembering does not work. Ours runs as automated gates in every project's delivery pipeline, from the first design session to the backup that restores at 3am.
Design
- Threat model for every new system, written before the first sprint
- Data classification: what is personal, what is sensitive, where it may live
- Privacy by design for India DPDP Act, GDPR/UK GDPR, Singapore and Malaysia PDPA, UAE PDPL
Code
- OWASP ASVS and OWASP Top 10 as the review checklist
- Static analysis (SAST) on every pull request; high findings block merge
- Secrets scanning on every commit and in history
- Dependency and licence audit with automated update PRs
- Mandatory peer review; no one merges their own code
Pipeline
- Signed commits and protected branches
- Build artifacts produced only by CI, never on laptops
- Separate dev, staging and production with no shared credentials
- Infrastructure as code, reviewed like application code
Cloud
- Least-privilege IAM, SSO and MFA on every console
- Encryption in transit (TLS 1.2+) and at rest
- Web application firewall, rate limiting and bot protection at the edge
- Private networking for databases; no public database ports
AI systems
- Prompt-injection and data-exfiltration tests in the eval suite
- No client data used to train third-party models; zero-retention API settings where offered
- Guardrails and human approval for agents that take actions
- Audit logs of model inputs, outputs and tool calls
Operations
- Centralised logging and alerting with on-call ownership
- Encrypted, versioned backups with tested restores
- Incident response runbook and written post-incident reports
- Access reviews and offboarding the day someone leaves a project
We practise it here too.
This website ships the same baseline we set up for clients: HTTPS only with HSTS, a strict content security policy, no third-party trackers, and security headers checked on every deploy.
- Content-Security-Policy
- Strict-Transport-Security
- X-Content-Type-Options
- Referrer-Policy
- Permissions-Policy
- Cross-Origin-Opener-Policy
Security questions
Something else? Ask us directly. First reply within 4 hours.
Are you ISO 27001 or SOC 2 certified?
Not today, and we will not pretend otherwise. We build and operate to the controls those frameworks expect, so clients who are pursuing certification get evidence-ready systems, access logs and documentation from us.
Will you sign an NDA and a data processing agreement?
Yes. We sign NDAs before discovery calls and data processing agreements whenever we handle personal data, including DPDP Act, GDPR and PDPA terms.
Who can access our production data?
Only named engineers who need it, through SSO with MFA, logged and reviewed. Most development uses anonymised or synthetic data so production access is rarely needed.
Can you run a security review of our existing app?
Yes. We run a code and configuration review against OWASP ASVS, scan dependencies and infrastructure, and deliver a prioritised report with fixes. For formal penetration testing we work with independent testers.
Want a security review of your app?
Send us the repository or URL. You get a scoped review plan within 48 hours.