Security
If you have us build an application, company data goes into it. This is how that is set up, in plain language, so your IT colleague or accountant can work with it.
Last updated: 12 August 2026
Access
- Every application has its own login. There is no shared account between clients and no shared environment holding two clients' data side by side.
- Passwords are stored hashed with bcrypt and are not readable, including by us.
- Where it works better on the shop floor we use a PIN on a shared device rather than a password per person. That is a deliberate fit to the process, not a shortcut.
- Our own admin environment sits behind a separate login and is not indexed by Google.
Hosting and transport
- Everything goes over https; unencrypted traffic is not possible.
- The database is reachable only from the application, not from the open internet.
- Data is encrypted at rest at the hosting provider.
- There is no self-managed server for us to patch by hand; the platform handles that.
Backups and recovery
The database takes automatic backups with point-in-time recovery, so a mistaken action can be rolled back to a moment before it. The code lives in version control, so any version can be retrieved and rebuilt.
What we do not do is claim a monthly restore drill. If you want a specific recovery time or a periodic test, we put that in the contract rather than assert it loosely here.
Suppliers
| Party | Role | Where |
|---|---|---|
| Vercel | Hosting and delivery | European edge network, server code currently in the US |
| Neon | Postgres database | Region depends on the project |
| Vercel Blob | File storage for imagery | At the hosting provider |
That is the full list for this website. If we build an application for you, you get the list that applies to that application up front, including any AI supplier, and it goes into the data processing agreement.
Your code and your data
The source code and the data are yours. The setup is transferable from day one: you can take the application to another party or to your own environment without anything needing a rebuild. That is not a favour granted afterwards but a design choice made up front, and it is in the terms as well.
Reporting a vulnerability
If you see something wrong, report it to the email address in the footer. Give enough detail to reproduce it.
We respond within five working days, keep you posted on the fix, and will not take legal action against anyone who reports a problem reasonably and does not access more data than needed to demonstrate it. Please do not publish before it is fixed; for a normal issue that is within thirty days.