Security & quality
Practices applied consistently, not declared once and forgotten.
We ground how we talk about security in concrete practices, applied across client projects and our own products: access control, server-side validation, data separation, backups, monitoring, and testing before launch.
The level of controls, monitoring, availability and recovery is set based on each project’s risks, architecture and contractual requirements. Below, we mark what we apply as a baseline standard versus what depends on infrastructure and contract — plus what stays, in every case, the client’s responsibility: keeping access credentials safe, timely approval of changes with security impact, and prompt communication of any special requirements for sensitive data.
Authentication & access control
Role-based authentication, with access strictly limited to the data each type of user needs — applied consistently across the applications we build and our own products.
Server-side validation
We don’t rely on interface validation alone — data is checked again on the server, where it actually matters for security.
Data separation
In applications that serve multiple clients or users (multi-tenant), each one’s data is explicitly isolated.
Testing before launch
We verify functionally and with real users before launch — part of our 12-step process.
Human-in-the-loop for AI
For decisions with real impact, AI proposes and a human confirms — we don’t fully automate decisions that can affect customers or the business without a check.
Security updates
Dependencies and infrastructure are updated periodically — the exact frequency and scope depend on the infrastructure the project runs on and the agreed maintenance contract (see also maintenance & infrastructure).
Backup & recovery
We recommend a tested backup plan, not just a configured one. Acceptable recovery time (RTO/RPO) and who operates it — us or the client’s infrastructure — are set explicitly per project.
Continuous monitoring
We recommend actively tracking uptime, errors and performance, with alerting. The monitoring level implemented depends on the infrastructure and the agreed operating budget.