Security
Your code, data and accounts, handled with care.
How we protect client information on every project, from the first call to handover, and how to report a security issue to us.
Confidentiality and NDAs
- Mutual NDA available before the first technical conversation.
- Every team member signs confidentiality terms as part of their contract.
- Client code, data and documents are never reused or shown without written permission.
Access control
- Least-privilege access: people get only the systems their project needs, for as long as they need them.
- SSO and multi-factor authentication on every tool that supports it.
- Access is reviewed at each milestone and removed the day a project or role ends.
You own the accounts
- Repositories, cloud accounts, domains and ad accounts are created in your organisation, not ours.
- We work as invited users you can remove at any time.
- Credentials are shared through an encrypted password manager, never by email or chat.
Encryption
- TLS 1.2+ for all data in transit, with HSTS on the sites we build.
- Encryption at rest for databases, backups and object storage using the cloud provider's key management.
- Secrets stored in a managed vault or the platform's secret store, never in source code.
Secure development
- Code review on every change and protected main branches.
- Automated dependency and secret scanning in CI, with patches applied on a fixed schedule.
- Development follows the OWASP Application Security Verification Standard (ASVS) for the risk level agreed with you.
Backups and recovery
- Automated daily backups with retention agreed per project.
- Restores tested at least quarterly on the platforms we manage.
- Recovery time and recovery point objectives written into the runbook we hand over.
Infrastructure hardening
- Infrastructure defined as code and reviewed like application code.
- Servers and containers built from hardened baselines aligned with CIS Benchmarks.
- Centralised logging and alerting for production systems we operate.
Incident response
- A named incident lead and an escalation path agreed at kickoff.
- Clients are told about any incident affecting their data without undue delay, and within the time their regulator requires.
- Every incident ends with a written post-mortem and follow-up actions.
Responsible disclosure
Found a vulnerability?
Email support@nandnsolutions.com with the subject “Security report”, steps to reproduce and the affected URL. We acknowledge reports within two business days and keep you updated until it's fixed. Please give us reasonable time to fix the issue before disclosing it, and don't access or change data that isn't yours.
Machine-readable contact details are published at /.well-known/security.txt.
Where is our data hosted?
In the cloud account and region you choose. When data-residency rules apply — for example GDPR in the EU and UK, or national data-protection laws in the Middle East and Asia — we host in the required country or region.
Can you sign our security questionnaire or DPA?
Yes. We complete vendor security questionnaires and sign data processing agreements as part of onboarding.
Do you hold certifications such as ISO 27001?
We follow the practices on this page on every project. If your procurement requires a specific certification, ask us and we'll tell you exactly where we stand and what evidence we can provide.
What happens to our data at the end of a project?
We remove our access, hand over all credentials, and delete any copies of your data held on our systems, confirming in writing when it's done.
Need a security review before you sign?
Send us your questionnaire or DPA. A senior engineer will answer it and walk your team through how we'd handle your data.
- Reply within 2 business hours
- NDA on request
- You own the code and accounts
Free 30-minute consultation
With a senior engineer, not a salesperson.