Get in touch

Trust and security

Security practices

We do not yet hold formal certifications like SOC 2 or ISO 27001. Rather than imply otherwise, here is what we actually do, in plain terms, to keep your data and code secure.

Protecting your dataCode and credentialsIf something goes wrongWhere we are headedReporting an issue

No formal certification yet, and we say so plainly rather than imply otherwise. What we do have: encrypted connections, access controls, code review on every change, secrets kept out of source control, and a real plan for if something goes wrong.

Protecting your data

The basics, done consistently.

Encryption in transit

Connections between your systems and anything we build run over HTTPS and TLS, not plain unencrypted traffic.

Secrets management

API keys, database credentials, and other secrets are kept out of source control entirely and managed through a proper secrets manager.

Least-privilege access

People and systems get access to only what they need for the task at hand, not broad standing access by default.

Environment separation

Staging and production are kept separate, so testing and review never touch live customer data unless explicitly required and agreed.

Code and credentials

How we treat what we build.

Code review on every change

No change reaches production without a second person reviewing it first, including under a tight deadline.

Dependency and vulnerability scanning

Ongoing scanning for known vulnerabilities in the libraries and packages a project depends on.

Access controls on repositories

Source code access is limited to the people actively working on a project, revoked when an engagement ends.

No credentials in source control

Application secrets never get committed to a git repository, checked by both process and automated scanning.

If something goes wrong

Honest about what we would actually do.

  • We tell you promptly if something affecting your data or systems goes wrong. No delay to soften the news.
  • We investigate the root cause, not just patch the symptom, and share what we found.
  • We fix the immediate issue first, then look at whether the same class of problem exists elsewhere in the system.
  • We do not have a dedicated, formal incident response program with published SLAs today. What we do have is a small senior team that treats a security issue as the top priority the moment it is known.
Where we are headed

Certifications are a when, not a never.

Formal certifications like SOC 2 are a real, paid audit process, typically running into the thousands of dollars and taking months with an accredited auditor. Right now, we are putting that budget into delivery instead.

As we take on larger clients and the need for a formal certification becomes concrete rather than precautionary, it is on our roadmap. Until then, this page is the honest, current picture of what we actually practice, not a claim we cannot back up.

Reporting an issue

Found a problem? Tell us directly.

If you believe you have found a security issue in something we built or in this site, email contact@virtualconsonance.us with details. We will acknowledge it, treat it seriously, and follow up directly.

Have something in mind?

Tell us what you are trying to build or fix. We will give you a straight read on what it takes, and if we are not the right team, we will tell you that too.

Get in touch