Last updated: September 26, 2026
Clients trust CodeBase Coders ("we," "us," or "our") with source code, production systems, and sometimes their own customers' data. This page explains how we protect that trust in our engagements and on this website, and how we support the compliance requirements of the industries we work in.
Our Approach
Security is part of how we build, not a phase at the end. It is planned during discovery and architecture, checked throughout delivery, and handed over with documentation so your team can keep operating it after launch.
Secure Development Practices
- Security planning up front — authentication, authorization, data flows, and likely threats are designed before code is written.
- Code review — changes are peer reviewed before they are merged.
- Automated checks in CI/CD — automated tests and dependency scanning run in the delivery pipeline from the first sprint, so known-vulnerable libraries are flagged early.
- Security testing before release — applications are tested against common web and mobile risks, such as those in the OWASP Top 10, before real users depend on them.
- Encryption — data is encrypted in transit, and encrypted at rest where the platform and project support it.
- Secrets management — credentials and API keys are kept out of source code and stored in environment configuration or a secrets manager.
- Least privilege — role-based access is built into the applications we deliver, and our own access to client systems is limited to what the work requires.
Protecting Client Data and Code
- Confidentiality — we are happy to sign a Non-Disclosure Agreement before you share project details.
- Your environments, your control — where possible we work in repositories and cloud accounts you own, so you can grant and revoke access yourself. Ownership of the work we deliver is set out in your contract.
- Access removal — when an engagement, or a team member's involvement in it, ends, the related access to your systems is revoked.
- Production data — we avoid using real customer data in development and test environments; where it can't be avoided, we agree handling rules with you in advance.
Supporting Your Compliance Requirements
Many of our clients operate under regulations such as GDPR, HIPAA, or PCI DSS, or are working toward frameworks such as ISO 27001 or SOC 2. Compliance obligations sit with the organization that operates the system, but we help you meet them by:
- Capturing your regulatory requirements during discovery and designing for them from the start.
- Building in controls such as audit logging, access control, data retention rules, consent handling, and encryption.
- Providing technical documentation your auditors or compliance team can use.
- Signing a Data Processing Agreement where we process personal data on your behalf.
If your procurement process includes a security questionnaire, we will complete it accurately and in full.
Security of This Website
- All traffic is served over HTTPS.
- Forms are protected against cross-site request forgery, and every submission is validated on the server.
- File uploads through our contact forms are limited to document types (PDF, DOC, DOCX) and to a maximum size.
- Login attempts to our admin area are rate limited, and access is restricted to authorized staff.
- Non-essential cookies are only set with your consent. See our Privacy Policy and Cookie Policy for how we handle your information.
Reporting a Vulnerability
If you believe you have found a security vulnerability in this website or in a system we maintain, please tell us through our contact page with "Security" in your message, including enough detail for us to reproduce the issue. Please give us reasonable time to investigate and fix it before disclosing it publicly, and don't access, modify, or delete data that isn't yours while testing. We will acknowledge your report and keep you updated as we work on it.
Changes to This Page
We update this page as our practices evolve. The "Last updated" date at the top reflects the most recent revision.
Contact Us
Questions about our security practices, or requests for an NDA, DPA, or security questionnaire, can be sent via our contact page.