Security & delivery

Delivery practices that protect your systems and data.

Security and reliability are part of the engineering, not a final check. These are the practices we follow on every engagement. Specific requirements are agreed with your team.

See the controls Share your requirements

At a glance

Least privilegeIndividual accounts with MFA, removed when the work ends
Reviewed changesEvery change checked by another engineer
Separate environmentsDevelopment kept away from live data
No training on your dataBusiness AI services only
Your policies applyAgreed in writing before work starts

Controls

Six control areas, on every engagement.

These are the defaults. Where your policies ask for more, we agree it in writing and follow it.

Access

Least-privilege access to your systems and data
Individual accounts with multi-factor authentication, never shared credentials
Access removed when the work ends

Code and releases

Every change reviewed by another engineer
Automated tests and dependency checks in the pipeline
Releases that can be reversed

Environments and data

Development and testing kept away from live systems
Customer data in testing only when agreed, and minimized
Data encrypted in transit, and at rest where the platform supports it

Secrets

Secrets kept in a managed store, never in code or chat
Devices with disk encryption, screen locks and current updates
Access reviewed regularly

AI and your data

Business AI services whose terms do not allow training on your inputs
No client data in consumer AI tools
AI-assisted code reviewed like any other change

Decisions and handover

Scope, architecture and trade-offs recorded in writing
Documentation and tests handed over with the code
Your policies applied and confirmed in writing

Across the lifecycle

Security at every stage, not a final check.

The same six stages as how we work, with the security work each one carries.

1Understand
Confirm which data the work touches, who owns it and which policies apply.
2Shape
Record access, data flow and hosting decisions in writing before building.
3Build
Reviewed changes, automated tests and dependency checks on every release.
4Connect
Dedicated service accounts with the narrowest permissions, secrets in a managed store.
5Validate
Test against the controls you require, with minimized or synthetic data.
6Improve
Monitoring, patching and removing access that is no longer needed.

Sensitive data

Healthcare, financial and other regulated data.

Designs for sensitive records start with who may see what, and how every access is traced.

A row of data cylinders, one lifted into a narrow beam of light for controlled access

Strict role-based access and audit trails on sensitive records
Minimized or synthetic data in development and testing
Designs shaped by the rules that apply, such as HIPAA or UK GDPR
Hosting provider and region chosen to match your requirements
Controls agreed with your compliance team before work starts

We are not a law firm or an auditor. We build to the requirements your compliance team sets, and record how each one is met.

If something goes wrong

Incident response in four steps.

From our Cybersecurity Policy. You are told early, with facts, not after the fact.

1
Contain
Stop the problem spreading: revoke access, isolate systems, preserve evidence.
2
Respond
Our response begins within 24 hours of becoming aware of an incident.
3
Notify
We tell you without undue delay what we know and what we are doing.
4
Learn
A written review of the cause and the change that prevents it happening again.

Before we start

What to send us.

Your policies and requirements shape the controls on the engagement. We agree them in writing before work starts and follow them throughout.

Your information security policy
Data protection or processing terms
Access and hosting requirements
Any security questionnaire you use
An NDA, if you need one first

Share your requirements

Policies

The detail, in writing.

How we work

PolicyCybersecurity PolicyThe full set of practices every person on an engagement follows.PolicyAI Usage PolicyHow AI is used in delivery and in the AI systems we build.PolicyPrivacy PolicyWhat this website collects and how it is used.PolicyTerms of ServiceConfidentiality, ownership and how engagements are agreed.

FAQ

Security questions buyers ask

Is CodeWorx ISO 27001 or SOC 2 certified?

No. CodeWorx does not currently hold formal security certifications such as ISO 27001 or SOC 2. Where an engagement needs specific controls, they are agreed in writing and followed for the engagement.

How do you control access to our systems?

Access is limited to what the work requires, every person uses an individual account with multi-factor authentication, credentials are never shared, and access is removed when the work ends.

Will our data be used to train AI models?

No. Your data is used only to deliver your project. We use business AI services whose terms do not allow the provider to train on your inputs, and we do not put client data into consumer AI tools.

Can you work with healthcare or financial data?

Yes. Designs for sensitive data include strict access control, audit trails and minimized data in testing, shaped by the rules that apply, such as HIPAA or UK GDPR, and agreed with your compliance team.

Will you follow our security policies?

Yes. Send your policies and requirements before work starts. We agree them in writing and follow them for the engagement, and we sign an NDA on request.

What happens if there is a security incident?

We contain it, begin our response within 24 hours and notify you without undue delay with what we know and what we are doing, then support any notifications you need to make and write up what changes.

Get a proposal

Have specific security requirements?

Tell us what your policies require. We agree controls in writing before the work starts, and sign an NDA on request.

1We read your brief properly
2You speak with people who can discuss the business and the engineering
3You get a clear next step: a scoped engagement, a discovery phase or a proposal

Start a conversation

Fields marked * are required. Plain language is fine.

Most projects cross more than one discipline.

Modernizing an operations platform without stopping the business

Software shaped around how the business operates.

8 client projects across healthcare, SaaS, logistics, legal and insurance.

The AI Feature Launch Playbook

From first release to long-term support, the same people.