Home / Trust pages and intellectual property
Discuss security requirements before the build.
Security expectations need to be defined for the product, data and environment involved. We work with you to identify relevant controls and responsibilities before implementation.
Access and environments
Agree who needs access, which permissions are appropriate and how accounts and environments are owned and managed.
Data and integrations
Identify the information the application handles, the services it connects to and the boundaries that need to be maintained.
Development and release
Define code review, testing, deployment and incident responsibilities according to the project scope and operating requirements.
Specialist requirements
- If a project involves regulated data or a specific certification requirement, raise it during the initial discussion. Applicable standards, evidence and specialist work need explicit review
- This page is not a statement of certification
Practices
How we protect your systems and data
These practices apply by default and can be extended to meet your security policy. We do not claim certifications we do not hold; specific requirements are agreed in the contract.
Access control
Project access is granted per person and per system, reviewed during the engagement and removed when work ends.
Secure development
Code review, dependency scanning and secrets management are part of our standard workflow.
Data handling
We use the minimum data needed, prefer anonymised or test data and follow your rules for production data.
Infrastructure
Environments are separated, connections are encrypted and cloud accounts can remain under your ownership.
Confidentiality
NDAs and confidentiality clauses can be signed before you share sensitive material.
Incident response
Issues are reported promptly, investigated and documented, with follow-up actions agreed with you.
Your requirements
Working with your security team
- Complete security questionnaires and provide technical documentation
- Follow your access, device and data handling policies
- Use your identity provider and VPN where required
- Agree incident reporting contacts and timelines
- Support penetration tests and remediation of findings
FAQ
Security questions
Do you sign NDAs?
Yes, before confidential information is shared.
Can our production data stay in our environment?
Yes. We can work with test or anonymised data and access production only as you permit.
Do you follow secure coding practices?
Yes, including code review, dependency scanning and secrets management.
Can you work within our compliance framework?
Yes. We follow the controls your compliance team defines; regulatory responsibility remains with your organisation.
Tell us what you want to build or improve
Share your goals, current situation and the help you need. We will review your message and discuss a practical next step.