--- title: "Security Practices | Cyan Orbit" description: "How we protect client code and data through access control, secrets management, secure development practices and compliance support." url: https://cyanorbit.com/security --- 1. [Home](https://cyanorbit.com/) 2. Security Security # Security is a set of practices, not a claim Below is how we handle access, secrets, secure development and data, described as commitments you can hold us to rather than results we cannot prove. [Get a project estimate](https://cyanorbit.com/get-a-quote) NDA on request · Free, no-obligation estimate · Reply within one business day Practices ## How we protect your code and data ## Confidentiality We sign an NDA before discovery begins, whenever a client asks for one, and treat project details, code and data as confidential by default rather than waiting to be asked. ## Access control Access to your systems and repositories is granted on a least-privilege basis: engineers get access to the part of the project they are working on, not the whole environment by default. - Single sign-on and multi-factor authentication enforced on every tool we use - Access reviewed regularly and revoked immediately when someone leaves the project or the company ## Secrets management API keys, credentials and other secrets are stored in a dedicated secrets manager rather than in code, configuration files or chat messages, and are rotated when a project ends or a team member's access changes. ## Secure development lifecycle Security is checked at each stage of the build rather than left for a final review before launch. - Code review on every pull request, from a second engineer - Automated dependency and vulnerability scanning on every build - Static application security testing (SAST) run in continuous integration - OWASP ASVS used as a reference for the level of rigour a given system needs ## Data handling Personal data from your production systems does not belong on a developer's laptop. - No production personal data copied to developer machines - Anonymised or synthetic data used for development and testing - Hosting region chosen by you, so data residency follows your requirements ## Compliance support for your programme We are not a certifying body. We build software to support the compliance programme you already run, or are setting up, with your legal and compliance advisors making the final call on what it requires. - GDPR and UK GDPR: data protection by design, and a data processing agreement on request - HIPAA: technical safeguards such as access controls, audit logging and encryption for systems handling protected health information - SOC 2: evidence and documentation prepared to support your auditor's review, not a claim of our own certification - PCI DSS: scope reduction through tokenisation, so cardholder data touches as little of the system as possible ## Incident communication If we discover a security issue affecting your system, we tell you what we know, what we do not yet know, and what we are doing about it, as soon as we have something concrete to share, and keep updating you until it is resolved. Certifications ## Certifications and audit reports We list a certification or audit report on this site only when it is real, current and something you can verify independently. Where that is not yet the case, this space stays visible in development so it is not forgotten, and empty in production rather than filled with a claim we cannot back up. FAQ ## Security FAQs Do you sign an NDA before we share project details? Yes, on request, before discovery begins. Confidentiality applies to project details, code and data whether or not an NDA is in place, but we are glad to formalise it in writing. Are you SOC 2 or ISO 27001 certified? We list certifications and audit reports on this site only when they are current and verifiable, and we will tell you plainly if that is not yet the case for a given standard. Ask us for our current status and we will answer directly. Where is our data hosted? In the region you choose. We do not default to a single hosting location, since data residency requirements differ by client, industry and regulation. How do you manage credentials and secrets for our systems? Secrets are stored in a dedicated secrets manager rather than in code or chat, access is granted on a least-privilege basis with single sign-on and multi-factor authentication, and access is revoked immediately when it is no longer needed. What happens if there is a security incident affecting our project? We tell you what we know, what we do not yet know, and what we are doing about it as soon as we have something concrete to share, and continue updating you until it is resolved. ## Talk to us about your security or compliance requirements Share a few details about your project. A senior engineer reviews every request and replies with next steps, questions, and a rough budget range. [Get a project estimate](https://cyanorbit.com/get-a-quote?service=cloud-devops) [Talk to a developer](https://cyanorbit.com/contact)