Security and privacy
Secure by default.
Checked at every release.
Every app we run is built to one published standard, and reviewed against it every time it changes.
Checked twice
The server checks who you are and what you may do on every request. The database enforces the same rules again.
Secrets in a vault
Keys and passwords live in a managed vault, never in code. Privileged access is never used to serve a user.
Watched, quietly
Every instance is monitored, with alerts that have owners. No personal data goes into our telemetry.
Backed up, and tested
Backups are only real once you've restored one. We do, on a schedule, and keep the record.
Two-step sign-in
Staff accounts need a second factor. Your customer can use their own Microsoft 365 or Google sign-in.
Reviewed every release
Security, privacy, reliability and more, against the standard, every time. The report goes in your governance pack.
Your code, with us
Handled like the liability it is.
Source code carries secrets and confidences. We treat it that way from the moment it arrives.
Read-only, one repository
Our GitHub App asks only to read the repositories you choose, with short-lived access.
Scanned on arrival
We look for secrets and tell you exactly what to revoke. We never show the values.
Encrypted and kept apart
Stored encrypted, kept to your engagement, opened only by our staff, and logged.
Deleted on time
If you don't go ahead, your code is deleted 90 days after it arrives.
Privacy
Privacy is part of the standard, not an option.
Our privacy standard is built around South Africa's POPIA, UK GDPR and EU GDPR: collect only what's needed, keep it only as long as agreed, keep it where it's agreed, and let people see, correct and delete what's theirs.
Found a problem?
Tell us privately and we'll respond quickly. Thank you for helping keep everyone safe.