Security

Our approach

We work on least privilege: every person and service gets only the access needed for a specific task.

Security is built in from the start, from secret storage to code review before deployment.

Data protection

We apply reasonable technical and organisational measures:

• Encryption in transit (HTTPS/TLS)
• Encrypted secrets and backups
• Access control and individual accounts
• Regular updates of dependencies and servers
• Monitoring, logging and backups
• Separate development, staging and production environments

Access

Production, database and repository access is limited to staff and contractors who need it for their work.

We use a secrets manager, do not keep passwords in chats, and revoke access as soon as a project ends or a person leaves the team.

Infrastructure

Projects run on dedicated servers or with cloud providers. We choose providers for reliability and reputation but do not fully control their infrastructure.

Backups are made regularly; retention and frequency depend on the project and are agreed separately.

Integrations and bots

For integrations we request minimal permissions and use separate tokens. Bot tokens and sessions are stored securely.

Connecting WhatsApp by QR code does not require the account password. If a session is compromised, it can be revoked in the messenger settings; we will help reconnect the bot.

Payments

Invoice payments are processed by the bank, crypto payments by the blockchain network. We do not receive or store card details.

Crypto payments go directly through the network; we see the wallet address, amount and transaction status.

AI processing

Some tasks use AI models. Only the necessary data is shared; we do not use client data to train public models.

For sensitive projects we can agree on local models or a ban on sending data to external providers.

Incidents

We record, investigate and fix security incidents. If an incident affects client data and the law requires notification, we report it and the measures taken.

Client responsibilities

Security is shared. We recommend:

• Use strong unique passwords and a password manager
• Enable two-factor authentication on email and admin panels
• Do not send access details in open chats
• Revoke access for former employees and contractors
• Report suspicious activity promptly

Reporting a vulnerability

If you find a vulnerability, write via the contact page or email [email protected].

Please do not test against other people's data, do not change or delete their data, and give us time to fix the issue. We will not pursue researchers acting in good faith.

Updates

We review our security measures as projects grow and threats change. This page is updated together with our practice.