Trust Center · Security
Security
The controls Cystem X applies to every engagement, from how we write code to how we respond when something goes wrong.
Security is engineered into our delivery process rather than checked at the end. The practices below are the baseline we apply across projects, dedicated teams and managed services, and we adapt them upward for clients with stricter regulatory or sovereignty requirements.
Secure development practices
All code changes go through peer review before merging. Automated dependency and vulnerability scanning runs against every build to catch known-vulnerable components before they reach production. Secrets such as API keys and credentials are stored in a dedicated secrets manager and are never committed to source control.
Access management
We apply least-privilege access across client systems: engineers receive only the access their current task requires, for only as long as they need it. Multi-factor authentication is required for every account that can reach client systems or sensitive internal tooling, and access is reviewed and revoked promptly when an engagement ends or a team member's role changes.
Encryption
Data is encrypted in transit using TLS on every connection that carries client data, and encrypted at rest wherever client data is stored, whether in a managed cloud service or an on-premises environment. Encryption key management follows the practices of the underlying platform, or a client's own key management service when integrating with sovereign or air-gapped environments.
Monitoring and logging
Production systems we operate are monitored for availability and security events, with logs retained long enough to support investigation and audit. Alerting thresholds are agreed with each client so genuine issues are escalated quickly without drowning teams in noise.
Supplier and third-party security
Where a delivery depends on a third-party platform or subprocessor, we review that provider's own security posture before relying on it and document the data flows involved. We do not introduce new third-party dependencies into a client environment without that client's knowledge and agreement.
Physical and environmental security
Delivery work is carried out from managed facilities with access control for staff and visitors. Production systems we operate run on infrastructure provided by established cloud or hosting platforms, which carry their own physical security controls, or on client-provided infrastructure governed by the client's own facility controls.
Incident handling
If a security incident affects a system we operate or data we hold, we follow a documented incident response process: contain, investigate, notify affected clients, and remediate, followed by a written post-incident review once the immediate issue is resolved. Clients are kept informed throughout an incident, not only after it is closed.
See Compliance for the frameworks these controls are aligned with, or our Responsible Disclosure policy if you believe you have found a potential vulnerability.