How we protect your code, data and systems

Confidentiality

We sign a mutual non-disclosure agreement before you share anything sensitive, on your template or ours. Everything you tell us about your business, users and systems stays confidential, and we never mention a client or a project publicly without written permission.

Access control

Access is personal, minimal and temporary:

• every engineer uses a named account, never a shared login;
• multi-factor authentication is required on every service we use for your project;
• permissions follow least privilege and are limited to the systems a person actually works on;
• wherever possible, work happens in repositories and cloud accounts that you own and control.

Credentials and data

Secrets such as API keys and passwords live in a secrets manager or a password manager, never in source code, chat or email. Production data is used only when a task genuinely requires it; development and testing rely on anonymised or synthetic data. Work devices are encrypted, protected by a password and kept up to date.

Secure development

Security is part of how code is written, not a final checklist:

• every change is reviewed by a second engineer before it is merged;
• automated tests and CI pipelines run on every change;
• dependencies are scanned for known vulnerabilities and kept up to date;
• new features are threat-modelled and checked against the OWASP guidelines;
• infrastructure is defined as code, versioned and reviewed like application code.

Infrastructure and backups

For systems we operate, we use established cloud providers, encrypt data in transit and at rest, keep environments separate, and configure monitoring and alerting. Backups are automated, retained according to an agreed policy and tested by restoring them, not just by checking that they exist.

Incidents

If we become aware of a security incident affecting your systems or data, we notify you without undue delay, contain it, investigate the cause and share a written report with the remediation steps.

End of an engagement

When an engagement ends, we revoke our access to your systems, return or securely delete your data and credentials as you instruct, and confirm it in writing. You keep the code, documentation and infrastructure definitions.

Certifications

We don't currently hold a formal certification such as ISO 27001 or SOC 2. If your procurement process needs evidence, we complete security questionnaires, walk your team through our practices, and can work within your own security policies and tooling. Report a security concern to contact@sprintcodes.com.