Security posture

How we protect systems

Access control

- Role-based access with least-privilege defaults — users get only the access the job requires
- Authentication required for every system entry point; no anonymous access to business logic
- Separate access tiers for end users, administrators, and service accounts
- Access reviewed and updated on role changes, personnel changes, or project handover

Data protection

- Data encrypted in transit using TLS 1.3 and at rest using AES-256
- Secrets and credentials stored outside of code via environment-level secret stores
- No plaintext credentials in version control, logs, or error messages
- Database backups encrypted and stored separately from live data

Launch and operations

- Security review and dependency audit included before every launch
- Vulnerability scanning as part of the release process
- Named incident owner and response runbook defined per project
- Penetration test available on request for systems handling sensitive data

Also in trust center

Deployment model Data handling Support terms Implementation playbook