What we actually do, not what we promise
Everything below is enforced in code you can read on a project we run, not a policy statement written for a questionnaire.
Controls
Enforced in code, not in a policy document
Each of these runs on software we operate ourselves, not only on software we hand over — so the answers to your follow-up questions exist.
Tenant isolation, enforced by lint
A workspace filter on every query is not a convention here — it is a build-time rule. Cross-tenant reads need an explicit written exemption, which makes them a list somebody can review rather than something that happens quietly.
- Custom ESLint rule on service and repository code
- Exemptions require a stated reason
- An unscoped query fails the build
Authorisation at the query, not the button
Hiding a control is UX. The checks that matter run server-side: a JWT guard, a permission guard carrying the caller's rights, and a workspace scope on the data itself.
- JWT and permission guards on every route
- Roles resolved from the session, never the request
- Platform-admin access separated from tenant access
Secrets stay server-side
No key, token or provider credential reaches the browser. Anything prefixed for the client is treated as public by definition, because that is what it is once the bundle ships.
- Server-only environment variables
- No credentials in the repository
- Rotation on any suspected exposure
Hardened by default at the edge
Content Security Policy, HSTS, frame denial and MIME-sniffing protection on every response, with request size limits and tiered rate limiting behind them.
- CSP, HSTS, X-Frame-Options, nosniff
- Helmet and input sanitisation on the API
- Rate limits tiered by window
Official integrations only
Platform work uses documented authorisation flows. We do not build against unofficial endpoints or ask for a customer's password, whatever it would make possible.
- Official Meta and provider APIs
- OAuth, never password sharing
- Scopes limited to what the feature needs
Your code, your infrastructure
Source lives in your repository from the first commit and runs on accounts you own. Access is granted for the engagement and revoked at handover.
- No licence retained by us
- Named access, removed on completion
- Runbooks handed over, not held
Limits
What we do not claim
Naming the gaps is what makes the rest of the page worth reading.
We hold no certifications
No SOC 2, no ISO 27001. If your procurement requires one, we are not the right vendor today and will say so on the first call rather than the fifth.
We are not a penetration-testing firm
Our security review reads code and configuration from the inside. That finds a different class of problem to an external pentest, and the two complement rather than replace each other.
Security questionnaire to get through?
Send it. We will answer what is true and flag what is not, rather than returning a document full of qualified yeses.