Security and governance
We are engineers who build to a security standard, not a penetration testing firm. On a Norwegian education platform that meant national data protection rules, security testing across SPT, SSAT and NVA, and a migration of sensitive records with nothing lost.
Book a 30-minute scoping call Read what we do not do
If you need a certified penetration test or an ISO 27001 certificate, we will point you at firms who issue those.
| Where does our data sit Region, and who can reach it | Answerable |
|---|---|
| Who has access Named people, revocable | Answerable |
| How are secrets stored Vault, not config files | Answerable |
| What is logged And kept for how long | Answerable |
| What happens on a breach Written, and rehearsed | Often not |
Where the line is
Security services cover a wide range and buyers often need two different suppliers. Being clear saves you a wasted procurement round.
Not us
These need accredited firms. We work alongside them and fix what they find.
Us
This is the work that makes an audit survivable, and it happens during the build rather than after it.
Plain definitions
Security is three trades sharing one word. Buying the wrong one wastes a quarter and leaves the original problem in place.
An audit checks your organisation against a framework and produces findings against controls. A penetration test attacks a running system and produces a report of what got through. Secure development is building the thing so that both of those go well.
They happen at different times and by different people. A pen test on software that was never built with access control in mind produces a long report and an expensive quarter. We are the third trade, and we work alongside the other two.
Less than people expect, and more specifically than people expect. Access controlled and reviewed, credentials managed and rotated, changes logged, data classified with a retention rule, backups tested, and an incident process somebody has actually read.
Most of a certification is organisational rather than technical. The software side is a short list, it is cheap to build in from the start, and it is expensive to retrofit three weeks before an assessment. That timing gap is the whole reason this page exists.
What we build
What people ask us for
Every one of these arrives with a deadline attached, which is usually somebody else deadline.
Our work
Case study, Norway
The client ran a system that could no longer meet current security standards, holding years of records about children. A previous vendor had missed the delivery date and the deadline with schools was contractual. We rebuilt the platform in modules, ran security work covering SPT, SSAT and NVA, put a separate team on the migration, and stayed on for 60 days of warranty after go-live.
Technology
Six things, all of them cheaper during a build than after an assessment.
Who does the work
Security work needs people who will tell you what is wrong with something they built themselves. That is a cultural property rather than a certification, and it is easier to maintain in a small team.
You interview whoever we put forward. Ask what they would find first if they attacked their own last project, and see whether the answer is specific.
How we work
The models differ in one thing: how much of the management you hand over. Everything else, including who owns the code, is the same in all five.
Changing model later is normal. Augmentation into a dedicated team is the common direction, and the people stay.
Engineers join your team and work inside your process, your board and your code review.
A team that works only on your product, with a lead on our side running delivery.
A long-term engineering site under your standards, where we carry recruitment, HR, payroll and equipment.
04
One price for a scope that is genuinely settled, with the overrun carried by us.
Everything in the centre model, with the whole team moving into your own Vietnamese entity on an agreed date.
FAQs
No. Certification comes from an accredited body, and anyone telling you otherwise is selling something else. We build to the controls and help you answer the evidence questions.
Not as a certified service. We commission or work alongside a testing firm, then fix what the report finds. Marking our own homework would not be worth much to you.
On the engineering side, yes: residency, retention, deletion, access control and audit trails. Legal interpretation belongs with your counsel or DPO.
Send it. Remediation is straightforward work and we would rather start from a real finding than a general assessment.
Yes, including NDAs before repository access, which every engineer on your project signs.
In your own cloud tenant, in the region your policy requires, with access you grant and can revoke.
Answering a stuck questionnaire and fixing what it exposes is usually two to four weeks. Remediating a full pen test report, or building residency and audit trail into a system that has neither, is a project in its own right. Rebuilding a system that cannot meet the rules at all is larger again, as the Norwegian platform was. Pricing follows the engagement model above.
No. Those certificates come from accredited assessors and we are not one, so anybody telling you a development firm can issue them is worth walking away from. What we do is build the technical controls those frameworks look for, and fix what an assessor finds. We will name firms who do the assessment.
Same answer with different letters. The scheme decides what evidence you must produce; we build the software so the evidence exists. Take the question of whether a regime applies to you to counsel, because scope questions in these regimes turn on your sector and size rather than on your technology.
A client questionnaire or an audit finding is the fastest way to see what needs building. Thirty minutes and you will know what is engineering work and what needs an accredited firm.
