How we keep your project secure
You entrust us with your code, your data and access to your company. This page describes the concrete practices we follow in every project – so you know where you stand.
Your code, your data, your access. From day one they belong to you – we simply look after them.
Our practices
Confidentiality from the first conversation
Everything you tell us about your company is treated as confidential – even before anything is signed. On request, we sign an NDA before the first meeting.
Access under control
A password manager, two-factor authentication and the principle of least privilege: everyone has access only to what they need. When our work together ends, we hand back all access and document it.
Your code, your data
The repository and infrastructure belong to you from day one. In test environments we work on test or anonymised data rather than production personal data.
Backups you can actually restore
In the systems we maintain, we set up automatic backups and periodically test restoring them. The tests help check the recovery process and prepare for a failure.
Updates and dependencies
We regularly update the software and servers of the systems we look after. We track announced vulnerabilities and prioritise fixes according to their impact on the system.
Honesty about incidents
If an incident occurs, we explain what happened, its potential impact and the actions we are taking. We share a recovery plan and keep you updated on progress.
Want to check your company’s security?
We apply the same practices in client projects. When we take over a system and as part of ongoing support, we carry out security reviews. The result is a short, prioritised list of concrete actions you can start on straight away.
- Application review for common vulnerabilities
- Server and infrastructure hardening
- Backup strategy and restore testing
- Inventory of accounts, passwords and permissions
What you get as a client
- A data processing agreement (GDPR) when the project requires one.
- A clear clause in the contract: the code, data and documentation belong to the client.
- Handover and inventory of all access at the end of the engagement.
- The option to review our practices before the project starts – just ask.
Details of how we process personal data are set out in our privacy policy.
Found a vulnerability?
If you have found a security flaw on our website or in a system we maintain, let us know. We respond to every report, we do not pursue anyone who reports in good faith, and we will gladly thank you publicly if you wish.
Let’s talk about security for your project
Ask about any practice on this page or request an NDA before the first conversation.
What happens next
- We reply and suggest a time to talk.
- We talk for 30–45 minutes about what gets in your team’s way today.
- You get a written summary and a proposed first step.
Prefer email? hello@nardeo.com