Security

Security is part of how Detix Services builds, not a layer added at the end. This page describes the practices behind our work and how this website itself is set up.

This site is deliberately small. It has no accounts, no sign-in, and no client data — which removes most of the surface a company site would otherwise have to defend.

Changes are reviewed before they merge. Dependency advisories are read and updates applied deliberately, rather than in a rush after something breaks. Every change has to pass the type checker and a full production build before it can ship, so a broken change fails before anyone sees it.

Secrets stay out of source control. Access to the systems that hold them is granted per person, not shared.

The safest data is the data we never collect. This site stores no test results, no source code, and no client records. The contact form sends us exactly what you typed — guarded by an invisible bot check, with no account behind it — and beyond that, what reaches us is the standard technical logs the infrastructure produces, and nothing more. Our privacy policy sets out exactly what that is and how long we keep it.

The site is served over HTTPS, so traffic between your browser and it is encrypted in transit with TLS.

It runs on managed hosting, which puts operating-system patching and physical data-centre security in the hands of people who do that work full time.

Access to our accounts and infrastructure is limited to the people whose work needs it, granted individually rather than through shared logins, and removed when a role changes. We require multi-factor authentication wherever the provider supports it.

Our work means looking closely at how a team builds and ships: repositories, pipelines, test suites, environments, and the decisions around them. Every engagement runs under a separate written agreement that sets out confidentiality, what we may access, and what happens to client material when the work ends.

We take only the access an engagement needs — read-only where the work allows it — and keep client material inside the client's own systems wherever we can. Findings belong to the client, and we do not reuse a client's material or name them elsewhere without permission.

We hold no security certification, and we will not imply one. When we have something independently audited, this page will say what it is, who issued it, and what it covers.

If a procurement process needs a security questionnaire completed, write to us and we will answer it straight — including where the honest answer is "not yet".

If you believe you have found a vulnerability in this site, tell us before you tell anyone else. Write to [email protected] with enough detail to reproduce it. We will acknowledge the report, investigate, and tell you what we find.

Keep testing to requests and data you send yourself — there are no accounts here to stay inside of. Avoid anything that degrades the service for other people, and give us reasonable time to fix an issue before publishing it.