Security & Compliance

Security built in, not bolted on.

Security is part of how we design, build, and run every project — from the first architecture decision to ongoing support. Here’s what we do, and what we commit to in our terms.

Secure development

Secure coding practices informed by the OWASP Top Ten, including input validation, output encoding, and protection against SQL injection, cross-site scripting, and cross-site request forgery.
Internal code review of the code we write before it is delivered.
Development and staging environments kept separate from production.
Dependencies kept current, with security patches applied to the dependencies we manage.
Secrets and credentials never stored in source code or version control.

Protecting your data

Encryption in transit using TLS, and encryption at rest where the project requires it.
Role-based access control and least privilege — people and systems only get the access they need.
Client credentials, API keys, and tokens treated as confidential and shared only over secure channels.
Client data kept logically separate from other clients’ data.
Privacy by design: we collect and process only the personal data a feature needs.

This website and client portal

Served only over HTTPS, with HTTP Strict Transport Security.
A strict Content Security Policy and hardened security headers.
No analytics, advertising, or tracking cookies.
Client portal data scoped to each signed-in client, with sign-in handled by an established authentication provider.
API keys for client websites stored only as secure hashes.

What we commit to

UK GDPR and EU GDPR — We process personal data in line with UK and EU data protection law. Our Privacy Policy explains what this website collects and why.
Data Processing Addendum — Where we process personal data on your behalf, we sign a Data Processing Addendum on request or where the law requires one.
Confidentiality — Your information, code, and business details are confidential under our Terms of Service, and we’re happy to sign an NDA before a project starts.
Incident notification — If we confirm a security incident affecting your data on systems we manage, we notify you without undue delay and within any timeframe the law requires.
Security testing on request — Penetration testing, security audits, or specific standards such as OWASP ASVS can be agreed as part of your project scope.

Found a security issue?

Tell us privately at contact@akazukiworks.com.