Loading…
Loading…
Home / Security
Approachtrust · gates · your data
Objections are answered with a gate list. If a gate is missing, we do not claim it.
Every claim on this page is a process you can check — not an adjective you have to take on faith. If we cannot point to the mechanism, the gate is not listed.
API keys, tokens and passwords are scanned on every release and never shipped in browser bundles.
Evidence — Gitleaks before deploy.
The browser never talks to your database directly. Every read and write goes through a server check.
Evidence — No public keys in the browser.
Known vulnerabilities in what we ship are checked before a change is released.
Evidence — CVE check before each change.
An independent programmer reads the diff before anything reaches your production.
Evidence — Independent programmer on every build.
The system proposes. Nothing customer-facing goes live without your click.
Evidence — The system proposes. You click.
Consequential actions write a trail — who did what, and when.
Evidence — Actions leave a trail.
Intake data stays in the EU. A data processing agreement is available on request.
Evidence — DPA on request · EU hosting for intake.
Before a release there is a snapshot. A change that fails can be reversed.
Evidence — A change that fails can be reversed.
Code, documentation and access live in your account from the first commit.
Evidence — Replaceable by design.
The boundaries are written down before you start — not discovered after a problem. Three documents cover the lifecycle.
What happens to your data: export, clean exit, deletion.
Download (PDF) ↓What you receive at the end: docs, repo, access, optional care.
Download (PDF) ↓Legal & Privacy — company data, privacy policy and the data processing agreement in one place.
No. It is a working checklist with evidence. If you need a certified pentest, we will say so and point you to one.
Intake form data is processed on EU hosting. Analytics are anonymous and consent-based. The full policy is on Legal & Privacy.
You. Nothing customer-facing sends or publishes without your click. The gate is architecture, not a setting you can forget.
Export, clean exit, deletion. The repo is already yours; the data safety playbook documents the exit path.
We do not claim certifications we do not hold. The gate list on this page is the claim — and each gate has evidence.
You send files. Written report is yours. Then a price for the build — or a clear no.