Security & trust
Cunnectit approaches security as part of discovery, architecture, development, deployment, and support—not as a checklist added at the end of a project.
Secure by design
Controls are selected for each engagement based on data sensitivity, application exposure, hosting model, and client needs.
Our security principles
The exact control set is documented in the project scope. These principles guide how we handle client information and design the systems we deliver.
Project information is used only to deliver the agreed work. NDAs are available, and access to client materials is limited to people who need them for the engagement.
We aim to request only the data required for discovery, development, testing, and support, with retention and deletion expectations agreed for sensitive projects.
Production connections use HTTPS, while credentials and integration secrets are kept outside source code. Encryption at rest depends on the selected database and hosting platform.
Applications can be designed with authenticated access, role-based permissions, session controls, and audit information appropriate to the sensitivity of the workflow.
Security is considered from architecture through release: input validation, server-side authorization, protected APIs, dependency maintenance, and focused testing are applied where relevant.
Backup frequency, retention, restore testing, and recovery responsibilities are defined with the client and implemented using capabilities available in the chosen platform.
Secure delivery
An internal inventory tool, a public web application, and a financial workflow do not carry the same risks. We align controls to the system, its users, and the consequences of failure.
We identify sensitive data, user roles, integrations, hosting constraints, and the business impact of failure before finalising the solution design.
Authentication, permissions, validation, logging, backups, and data flows are selected to match the actual project rather than added as generic promises.
Implementation includes focused reviews and testing for the agreed risks, with production credentials separated from development configuration.
We document deployment and operational responsibilities, remove unnecessary access, and agree how updates, incidents, and future changes will be handled.
Compliance readiness
Cunnectit does not claim blanket certification under SOC 2, ISO 27001, HIPAA, or similar frameworks. When a project has specific regulatory or customer requirements, we help translate them into scope, architecture, operating controls, and evidence.
Security enquiries
Share your hosting, data, access, compliance, or vendor-security requirements before development begins. For a suspected security issue involving Cunnectit, contact us with clear reproduction details.
