Security is a practice, not a badge.

What we build to

• Least privilege by default, on hosts and in application code.
• Small, boring, well-understood components rather than clever ones.
• Standards — OAuth 2.1, OpenID Connect, WebAuthn — instead of anything home-made, when identity ships.
• Separate products with separate data; one product's problem is not another's.
• No credential in a repository, a log, or a chat message, ever.
• Every claim on this site backed by something a reader can check.

Reporting a problem

Send reports to the company address with the subject line “security report”. A person reads it and replies; there is no ticket robot in front of it and no signature required before we look.

Tell us what you did, what you expected, and what happened. We confirm what we received, say whether it is a real issue, and tell you when a fix is deployed.

Please test only against accounts and systems you own or have written permission to test, and do not run denial-of-service tests or touch other people's data.

What we publish and what we do not

We publish this page, a trust page that describes what we hold and where it runs, and product-level detail once a product has a public release to describe.

We do not publish internal topologies, host names, vendor inventories, or the mechanics of our defences. A security page must not double as reconnaissance.