Security starts on day one of the build.

1. 1

   In your scope

   We write down what your site will hold, and who can see it.

   Before anything is built, your written scope comes with a plain list of the customer details your site will hold and who is allowed to see them. Who can see what is decided before a single page is written, so it is designed in and not patched on.

   You read it and correct it before you have paid anything.

   From a written scope. An example, for a booking site.

   • Names and phone numbers Seen by you and your front desk
   • Booking dates and times Seen by you and your front desk
   • Messages from the enquiry form Seen by you
2. 2

   In the build

   Nothing real, nothing secret, nothing extra.

   Three rules for the weeks your site is being built.

   • Real customer details on a laptop Made-up data, from day one. We build and test with it. Your customers’ details never go into AI tools either.
   • Passwords and keys in the site’s code Keys locked away on the server. From the first day they sit in a locked settings area, never in the code.
   • Every add-on going As few outside parts as the job needs. We check every one, so there is less that can go out of date.
3. 3

   On every change

   Every change is reviewed before it goes in.

   Automatic checks run on every change, and one of us reviews it before it goes in. We use AI to build, inside rule sets we wrote ourselves that hold it to our engineering and security standards. It does not approve its own work.

   1. A change is written
   2. Automatic checks run
   3. One of us reviews it
   4. It goes in

   Sign-in, payments and anything that touches personal details is reviewed by both of us.

4. 4

   Before launch

   Seven checks, and the launch waits if one fails.

   They are part of every package, not an add-on. A backup is restored as a test, and the completed checklist is kept with your job.

   Launch checklist all seven, every time

   1. Who can see whatCustomer details are visible only to the people who should see them.
   2. Passwords and keysNone are left in the site’s code.
   3. Forms and sign-insProtected against spam, guessing and misuse.
   4. Outside componentsEvery add-on is checked before it goes in, and again at each release.
   5. BackupsRunning from day one, with one restored as a test.
   6. A record of what happenedThe site keeps a log, so if something does go wrong we can see what and when.
   7. Your customers’ detailsThey never go into AI tools. We build and test with made-up data.
5. 5

   At handover

   Every key replaced. Everything in your name.

   On launch day we replace every key used during the build, so nothing from the build still works. Your web address, hosting and code are confirmed in accounts in your name, and you can leave at any time with no exit fee.

   Handover pack launch day

   • Your web addressIn an account in your name.
   • Your hostingIn an account in your name.
   • Your codeIn an account in your name.
   • Every key from the buildReplaced, so nothing used during the build still works.
6. 6

   After launch

   Kept patched, backed up and watched.

   A website is software, and new holes are found in software all the time. Faults are fixed free for 30 days and the first month of care is free. After that a care plan keeps your site looked after, from $150 a month. It is optional and runs month to month.

   See what each care plan covers

   • Patched Security patches on a schedule, to close newly found holes.
   • Backed up A copy saved every day, so a mistake or an attack can be undone.
   • Watched An alert tells us if your site goes down.

We will not tell you your site can never be broken into. Nobody can honestly promise that. What we can show you is that every step here was done.