Trust Centre
Secure development lifecycle
Security work that happens during delivery rather than as a gate at the end.
- Threat modelling during design
- We identify trust boundaries, assets and abuse cases while the design is still cheap to change, and record the decisions taken as a result.
- Automated checks in the pipeline
- Dependency scanning, secret scanning, static analysis, type checking and linting run on every change and block on real failures rather than warning into a log.
- Peer review on every change
- No change reaches the main branch without review. The main branch is protected, and migrations are checked before they can be applied.
- Penetration testing before high-risk production use
- Independent testing is scheduled before a system handling sensitive data or money goes into production use. We report the findings and the remediation rather than the fact that a test occurred.
- Dependency currency
- Dependencies are updated on a defined cadence with an emergency path for critical vulnerabilities. Deferred findings carry a recorded reason.
Questions
Ask us anything about this
Security and privacy questions reach a person who works on the platform, not a sales inbox.