How we work securely
How we work counts as much as what we build
This page describes how we handle infrastructure, access, data and changes. Written for the IT lead or compliance reader who wants to know what sits behind our software.
Infrastructure
- Our applications run on Microsoft Azure, in data centres in Europe.
- Development, acceptance and production environments are separated. Testing never happens on production data.
- We define infrastructure as code wherever possible, so an environment is reproducible and changes are traceable.
Access
- Sign-in through Microsoft Entra ID with two-step verification, for users and for our own team.
- Roles decide who sees and may do what. Everyone gets the minimum access needed for their work.
- Employee access is personal and traceable. Keys and passwords live in Azure Key Vault, never in code.
Data
- Data is encrypted at rest and in transit.
- Backups run automatically in Azure and recovery is tested periodically.
- We process personal data under the GDPR, with a data processing agreement and agreed retention periods. Data stays within the EU.
Changes and releases
- All code is under version control and reviewed by a colleague before it goes live.
- Builds and deployments are automated. A release goes to the acceptance environment first and to production after approval.
- Every release can be rolled back. What changed and when can be traced afterwards.
Maintenance and monitoring
- Applications are monitored for availability and errors. When something fails, we know before you call.
- We keep frameworks and packages current, including security updates and the end of support of platform versions.
- Response times, availability and reporting are set out in the SLA that comes with the maintenance agreement.
Regulation
- We know DORA and NIS2 and what they ask of financial institutions and their ICT suppliers: contractual agreements, incident reporting and insight into third-party risk.
- We take part in supplier assessments and due diligence and provide the documentation needed for them.
- We organise our processes along the lines of ISO 27001. Certification is planned.
The same principles, also outside .NET
C#, .NET and Azure are our specialty. When we choose another technology for a situation, such as Next.js and Vercel for a marketing site, the same principles for access, data and changes apply.
Questions from your compliance team?
Send us your supplier questionnaire or book a call. We answer the questions and provide the documentation you need.