Security & data protection

Security you can verify,not badges you can't.

Secure software development should be something you can check. Every practice on this page runs in production today, and we publish it so you can hold us to it.

TLS + HSTS preloadStrict Content-Security-PolicyCloudflare-protected edgeClient-owned repositories

Practices running in production.

This is how the platform serving this page is protected right now.

TLS everywhere

All traffic is encrypted in transit, with HSTS preload so browsers refuse to connect insecurely.

Strict Content-Security-Policy

A strict CSP controls what can load and execute on our platform, which blocks whole classes of injection attacks.

Cloudflare-protected edge

DDoS mitigation and a web application firewall sit in front of everything we serve.

Role-based access control

Least-privilege access across our platform: every role sees exactly what it needs and nothing more.

Automated dependency audits

CI audits dependencies on every build, so known-vulnerable packages don't reach production.

Automated backups

Backups run automatically, so recovery is a procedure rather than a scramble.

Second engineer on every merge

No change reaches a main branch until a second engineer has read it and approved it.

Client-owned repositories

Your code lives in your repository from day one, so it never exists only with us.

Your data, handled by contract.

Data protection here is contractual by default, so it never depends on best effort.

NDA before anything is shared

We sign before you send a single document. You never have to ask for confidentiality.

GDPR Art. 28 DPA with 2021 SCCs

For engagements involving EU personal data, we sign a GDPR data processing agreement under Art. 28 that incorporates the 2021 EU Standard Contractual Clauses.

UK addendum available

UK clients can add the UK international data transfer addendum on top of the DPA.

Data-minimized development

Production personal data stays out of development and test environments unless your contract specifically requires it.

Subprocessors

The full list of vendors behind our platform and what each one does. There are no hidden fourth parties.

Subprocessor	Purpose	Region
Cloudflare	CDN & edge security (DDoS mitigation, WAF)	Global network
Amazon SES	Transactional email	EU, eu-west-3 (Paris)
Stripe & PayPal	Payment processing	Global
VPS hosting	Application hosting	On request