Security Overview

Pillars

Infrastructure

We run on Cloudflare's edge network: Workers for application logic, D1 for relational data, R2 for object storage, and Cloudflare's DNS and WAF in front of everything. That gives us DDoS protection, TLS termination, and bot mitigation without operating servers of our own. We patch what we control and inherit patching for what we do not.

Access control

• Multi-factor authentication is mandatory on every account that can reach client data or production — no exceptions, including the founder.
• Hardware or app-based second factors only; SMS is not accepted for anything that matters.
• Production access is granted per project and per person, never as a standing team-wide role.
• Access is reviewed quarterly and revoked the same day someone leaves a project or the team.
• Every administrative action in Cloudflare and GitHub is logged and retained.

Secrets and credentials

API keys, tokens, and database credentials are held in Wrangler secrets or the equivalent secret store for the platform. Nothing sensitive is committed to a repository, pasted into a chat, or written into documentation. Repositories are scanned for secrets on every push, and a key that has been exposed anywhere is rotated immediately rather than quietly removed.

Application security

• All input is validated server-side; client-side validation is a convenience, never the control.
• Database access uses parameterised queries — no string-built SQL anywhere.
• Output is escaped by default and a Content Security Policy limits what a page may load.
• Authentication uses established libraries with well-reviewed session handling; we do not roll our own crypto.
• Public forms carry bot protection and rate limiting to prevent abuse and enumeration.
• Security headers — HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy — ship on every response.

Data handling

We collect the minimum needed to do the work and delete what we no longer need. Client production data is not copied onto laptops; where we need realistic data for development we generate or anonymise it. Devices are full-disk encrypted with automatic locking. Deleted records are removed from live systems immediately and age out of backups within 90 days.

Dependencies and supply chain

Dependency updates run automatically every week and land through a pull request with tests, so an update is reviewed, not merged blind. Critical advisories are handled the day we learn of them. We prefer fewer, well-maintained packages over convenience libraries, and every dependency added to a client project is one we are willing to maintain for the life of the project.

Backups and recovery

Databases are backed up daily with point-in-time recovery where the platform offers it, and source code lives in version control with full history. Restores are tested, not assumed. For client projects we agree a recovery point and recovery time objective in writing rather than leaving it to hope.

Incident response

If a breach affects personal data we notify the relevant supervisory authority within 72 hours of becoming aware, as GDPR Article 33 requires, and we notify affected people without undue delay where the risk to them is high. Every incident gets a written post-mortem covering what happened, what we changed, and how we would catch it earlier — shared with any client whose data was involved.

What we do not claim

We are a small studio and we would rather be accurate than impressive. We are not currently SOC 2 or ISO 27001 certified, we do not run a paid bug bounty, and we do not maintain a 24/7 security operations centre. What we do run is written above, and we are happy to complete a vendor security questionnaire honestly.

Reporting a vulnerability

Found something? Email security@webtechnosys.dev with enough detail to reproduce it. We acknowledge within two working days, keep you updated, and credit you publicly if you want the credit. Please do not test against production data, run automated scans that degrade service, or access anyone else's information — report it and we will take it from there.