Security

Security is part of how we design, build and operate. This page summarises our approach.

How we build

• Encrypted transport (TLS) and secure storage of sensitive data on device
• Secure authentication, session handling and least-privilege authorisation
• Input validation and OWASP Mobile and Web guidance
• Peer code review and dependency vulnerability scanning
• Secrets kept out of source control

How we handle your data

• Access to client materials limited to people working on the project
• Multi-factor authentication on our key accounts
• NDAs available on request
• Client cloud accounts remain owned by the client

Reporting a vulnerability

If you believe you have found a security issue in this website or an app we have built, email [email protected] with the subject “Security”. Please share details to reproduce and give us reasonable time to fix it before public disclosure. Do not access other people’s data or disrupt services. We appreciate responsible reports.

Limits

No system is perfectly secure. We do not make absolute guarantees but commit to reasonable, industry-standard safeguards.