Skip to main content
← Trust & Compliance

Information Security Policy

1. Purpose and approach

This policy describes how we protect our own systems and the systems we build for clients. Our practices are informed by ISO/IEC 27001 and OWASP guidelines. We are not certified ourselves, but we design the software we build with the controls that ISO 27001 and SOC 2 audits look for, and we aim for controls a small, fully remote team can actually operate every day.

2. Access control

  • Least privilege. People get access only to the clients, repositories, environments and data their current work requires. Production access is limited to named individuals per project.
  • Individual accounts. No shared logins. Where a system needs a service account, its credentials are stored in a company password manager or secrets store, never in code or chat.
  • Two-factor authentication (2FA) is enforced at organisation level on email, source-code hosting, cloud and hosting accounts, and password managers.
  • Access is reviewed at the start and end of each project, and at least every 6 months.

3. Devices

Contractors use their own devices. They must keep the operating system and browser up to date, use full-disk encryption and a screen lock, and not share the device account with others. Contractors confirm this in writing.

4. Secure development

  • We follow OWASP guidance (including the OWASP Top 10) when designing and building applications: input validation, parameterised queries, output encoding, secure session handling and protection of secrets.
  • Applications we build include role-based access control (RBAC) and, where the client needs it, audit logs of key actions such as logins, permission changes and access to sensitive records.
  • Data is encrypted in transit (HTTPS/TLS). Encryption at rest is enabled using the hosting provider's managed encryption where available.
  • Code review. Changes are made through pull requests and must be reviewed by another developer before being merged to the main branch. This is enforced with branch protection on client repositories.
  • Dependencies. We use automated dependency and vulnerability scanning tools to monitor third-party packages for known vulnerabilities, and apply security updates promptly.
  • Secrets are never committed to source code. Production data is not used in development unless agreed with the client and minimised.
  • Penetration testing. We support client-commissioned penetration tests and fix the findings. We do not run our own regular third-party penetration tests.

5. Backups

For systems we host or manage, we configure automated daily backups, keep them for 30 days separately from the primary system, and test restoration every 6 months. Where the client manages hosting, backups are the client's responsibility unless agreed otherwise.

6. Incident response

Everyone must report a suspected security incident (a lost device, a leaked credential, unusual access, a vulnerability) immediately to the Managing Director at [email protected] or +372 5675 8611. We then:

  1. contain the issue (for example revoke credentials, take a system offline);
  2. assess what happened and whether personal data was affected;
  3. inform the affected client within 48 hours of becoming aware, so they can meet their own legal obligations;
  4. fix the cause and record what we learned.

7. Onboarding and offboarding

  • Before getting access, contractors sign an agreement with confidentiality and security obligations and are briefed on this policy. We check identity and references. We carry out criminal record checks only when a client requires them.
  • When a contractor leaves a project or Swiftmade, we remove their access to all company and client systems on their last working day, rotate any shared secrets they knew, and ask them to delete any client data held locally.

8. Suppliers

We use reputable cloud providers and tools and enable their security features (2FA, logging, encryption). We review the security terms of new tools before using them with client data.

9. Breaches of this policy

Breaches of this policy may lead to removal from a project and termination of a contractor's agreement.