labs@atheron:~/security$ audit --everything
Security, built in
Then tested until it breaks.
Everything on this page is how we build and run our own platform today. Your project gets the same.
// how we build
The checks every project gets.
None of these is an extra. It is simply how the work is done.
mutation tests
We break our own code on purpose
A mutation test removes one rule at a time, and the tests must notice. A suite that passes anyway checks nothing, and we find that out before you do.
fuzzing
Fuzzing and property tests
Inputs generated by the thousand, looking for the one that breaks a rule. A fuzzer runs between test cycles at the lowest priority, so it never stops.
reviews
Adversarial reviews
At the end of each phase, reviewers who did not write the code try to break it: access, money, privacy and the edges of every form.
every 4 hours
Continuous verification
A separate server re-runs the type checks, the test suites, part of the mutation set, and dependency and secret scans every four hours, and reports what it finds.
every 8 hours
Backups every 8 hours
Every server is snapshotted and every database dumped every eight hours. Copies are kept and rotated, and a restore drill proves they work.
patching
Nightly patching
Servers take security updates every night, and dependencies are checked for advisories on every verification cycle.
least privilege
Least-privilege databases
Each service signs in to the database with its own login, and can do only what it needs. A public form can add a row but cannot read one back.
step-up
Step-up checks
Sensitive actions ask for a fresh passkey or code at the moment they happen, not only at sign-in.
privacy
Privacy inventories and retention
Every column of personal data is listed with how long it is kept. A job deletes it on time, and a test fails if a new column is not listed.
headers
Strict pages
A content security policy with a fresh nonce on every page, so an injected script does not run.
// data residency
Your data can stay in Canada.
You choose the region. For Canadian data residency we use Canadian regions, and we write down where every copy lives, backups included.
- digitalocean
- Toronto (TOR1), our default for Canadian clients.
- aws
- Canada (Central) in Montreal, and Canada West (Calgary).
- elsewhere
- Any region a provider offers, or your own Lenovo ThinkSystem servers on your premises.
// compliance
Ready for your audit.
We do not hold a SOC 2 report or any other certification, and we will never say we do. What we do is build so your audit goes smoothly:
- Access by role, with every grant and change recorded in an audit log that is sealed against tampering.
- Encryption in transit everywhere, and at rest for databases, backups and files.
- Written retention for every kind of personal data, enforced by code.
- Change control: every change tested, reviewed and recorded before it ships.
- Documentation of the controls, ready to hand to your auditor.
// note
If your project needs a certification, we work with your auditor and tell you plainly which controls we provide and which remain yours.
// start
Have a security question?
Ask it in your enquiry, or book a call. We would rather answer it now than after launch.