Discuss your project

Security

Enterprise-grade security, on independently certified infrastructure.

Everything we build runs on infrastructure independently certified to ISO 27001:2022 and audited to SOC 2 Type II, from the build platform to the database to the global edge network in front of it.

Accreditations

Infrastructure certified at every layer

Certified and audited

The international standards

The core information security standards, held across every layer we build and host on.

  • ISO/IEC 27001:2022

    Verified

    Build platform, database and edge network are each certified to the international standard for information security management.

  • SOC 2 Type II

    Verified

    Independent auditors test the security controls of every layer we host on, over time and not just on the day.

Assessed and tested

The specialist standards

Card industry, cloud privacy and penetration testing, checked by independent specialists.

  • PCI DSS Level 1

    Verified

    The edge network that serves and protects our sites is assessed at the highest level of the card industry standard.

  • ISO/IEC 27701 and 27018

    Verified

    Privacy management and protection of personal data in the cloud, certified on the edge network.

  • Annual penetration testing

    Verified

    The build platform is penetration tested by independent specialists.

Our controls on top

  • Every certificate is held by the provider of that layer and tested by independent auditors. Your system stands on all of them from the day it goes live.
  • On top, we build in access by role, so each person sees only the records, sections and sites their role allows.
  • Your data is encrypted in transit and at rest.
  • AI drafts, your people approve. Nothing involving money or anything sent outside the business goes ahead without a named person approving it.

Secure build

How we protect your data

  1. Every database table is locked down with row-level access control, so each person sees only the records they are entitled to.
  2. Roles and permissions are stored and enforced on the server, never trusted from the browser.
  3. Connections to accounting and other business systems use the provider's own secure sign-in, the minimum permissions needed, and tokens stored encrypted on the server.
  4. AI never moves money or sends anything external without a named person approving it. Every approval is logged.
  5. API keys and credentials are held in encrypted backend secrets, never in the app code.
  6. Your data is encrypted in transit and at rest.
  7. Every approval records who made the decision and when, and your data is backed up regularly.
  8. Data processing agreement and non-disclosure agreement signed before we touch client data.
  9. Independent penetration testing available on request for any system we build.
  10. A web application firewall in front of every system, and automated security scanning every time a system is published.

A full list of sub-processors is available on request under a confidentiality agreement.

Ask us anything

Questions about security?

Ask us exactly how your system will handle information, access and approvals. You get a straight, detailed answer before any work begins.

Ask a security question

Let’s talk

What job would you hand over first?

Tell us where the time goes. We will show you what we would build first, using software already proven in our own companies.

Discuss your project

Built on infrastructure independently certified: ISO/IEC 27001:2022 · SOC 2 Type II · PCI DSS Level 1