Your code, data and accounts stay yours
- Source code lives in your own repositories, such as GitHub or Azure DevOps.
- Applications are deployed to your own cloud subscriptions, not to accounts we control.
- You can review, audit or remove our access at any time.
Access control
- We request only the access each task needs, and nothing more.
- Multi-factor authentication is used on every account that can reach client systems.
- Access is reviewed regularly and removed promptly when an engagement ends.
Secure development
- Every change is peer reviewed before it reaches production.
- Dependencies are kept up to date and scanned for known vulnerabilities.
- Secrets such as passwords and API keys are kept in a secure store, such as Azure Key Vault, and never in source code.
- Applications are designed with the OWASP Top 10 risks in mind, including authentication, input validation and access control.
- Changes are deployed through automated pipelines, so every release is repeatable and traceable.
Data protection
- We handle personal data in line with UK GDPR and the Data Protection Act 2018.
- Production data is used only where strictly necessary; anonymised data is preferred for development and testing.
- Data is encrypted in transit and, where the platform supports it, at rest.
- A data processing agreement is available where we process personal data on your behalf.
Confidentiality
We are happy to sign a non-disclosure agreement before discussing your project, and we treat all client information as confidential whether or not one is in place.
Incidents
If we become aware of a security incident affecting your systems or data, we will notify you without undue delay, help contain and investigate it, and share what we learn to prevent it from happening again.
Reporting a vulnerability
If you believe you have found a security issue in this website or in a system we support, please email hello@vincitechnologies.co.uk with details. We will acknowledge your report and keep you informed as we investigate.