Security

The systems we build hold licence applications, personal data, case files and payments, for organisations whose reputations depend on keeping them safe. Security is a requirement of every project from the first design, not a check at the end.

What we do

• Secure design: who can see and do what, how users are identified, how data is protected in transit and at rest, and what is logged.
• Secure development: code written and reviewed against recognised guidance such as the OWASP Top Ten, with dependencies kept current.
• Data protection: systems designed to collect only what is needed, keep it only as long as needed, and support access, correction and deletion requests.
• Hosting: Microsoft Azure configured for encryption, backup, monitoring and patching, or guidance for your own infrastructure.
• Testing: security testing as part of QA, and support for independent penetration tests commissioned by you.

Reviews

We also review existing systems, ours or others', against the same checklist and report what we find in plain terms with a prioritised list of fixes.