Security & compliance

SOC 2 Type II audited. Your security review, already answered.

Outsourced engineering means trusting someone with your code, data and users. Below are the 18 controls we run on every engagement: how we vet people, build and test software, run infrastructure and handle your data.

Request our SOC 2 report Review the controls

SOC 2 Type IIOWASP Top 10TLS 1.2+ and KMS at restThird-party pen testing

The controls

Five areas, 18 controls, one standard on every engagement.

Written for whoever fills in your vendor questionnaire. If a control you need isn't listed, ask. We'll tell you plainly whether we meet it.

01 · 3 controls

Vetted people only

Only background-checked, NDA-bound people get access to your systems and data.

Every employee and contractor passes a background check before they're engaged, in line with local law and industry practice.
Everyone who needs access to sensitive or internal information signs an NDA or confidentiality agreement.
Ongoing security training and testing for all staff, covering current and emerging attack techniques.

02 · 4 controls

Secure development lifecycle

Security requirements are written into the design before the build starts.

Every project, from client products to support work, follows secure development lifecycle principles.
New products and major changes go through a design review that adds security requirements before build.
Everyone who writes code takes annual secure-development training in the languages they use.
Web development follows the OWASP Top 10.

03 · 3 controls

Independent testing

Third-party penetration testing and vulnerability scanning of every production and internet-facing system, on a regular schedule.

Every new system and service is scanned before it reaches production.
New systems and major changes are penetration tested for a real-world view of the environment.
Static and dynamic application security testing of all code, including open-source libraries, where the client contract includes it.

04 · 4 controls

Hardened cloud infrastructure

The same defense-in-depth controls in every AWS, GCP and Azure environment.

Production runs in private VPCs with strict inbound and outbound rules and segmentation between tiers.
TLS 1.2+ in transit; encryption at rest with provider-managed KMS keys.
Centralized logging, monitoring and alerting, with 24/7 on-call for mission-critical workloads.
Infrastructure as code (Terraform, CloudFormation), peer-reviewed, with automated drift detection.

05 · 4 controls

Data handling and privacy

Least privilege by default, audited, and limited to the scope of the engagement.

Role-based access with periodic reviews, and just-in-time elevation for any sensitive operation.
A data classification policy flags regulated data (PII, PHI, financial) and applies stricter controls end to end.
Retention and secure deletion follow your contract and the regulations that apply to you.
A maintained subprocessor list, shared on request, and incident-notification SLAs in every MSA.

For your security review

Send us your questionnaire. We'll send back the paperwork.

Questions about our SOC 2 scope, subprocessors or a specific control? An engineer answers them on the first call.

Request the security pack

SOC 2 Type II reportShared under NDA for your vendor assessment.
Your security questionnaire, filled inSIG, CAIQ or your own format.
Subprocessor listEvery third party that touches client data.
MSA security termsIncident-notification SLAs, IP assignment and data handling, in writing.