Security & Trust

Security by default, built into every project, not bolted on later

These controls apply to systems we build for you, infrastructure we operate on your behalf, and our own internal tools.

AES-256 at rest TLS 1.3 in transit RBAC + MFA SAST / DAST 13-month audit logs 90-day disclosure

Data classification

Every dataset is tagged with one of four classifications, which drives storage location, encryption keys, access scope, retention, and logging.

Class	Examples	Default controls
Public	Marketing copy, public API docs, press releases	No restrictions, integrity controls only.
Internal	Architecture diagrams, internal runbooks, team handbooks	RBAC, signed-in access, encrypted at rest.
Confidential	Client source code, business data, customer records	RBAC, MFA, AES-256 at rest, TLS 1.3, full audit log.
Restricted	PII, PHI, payment data, secrets, credentials	Per-project key, just-in-time access, hardware MFA, immutable log, no LLM exposure.

Encryption and key management

At rest: AES-256 mandatory for all production data: database volumes (RDS, Cloud SQL, managed Postgres), object storage (S3, GCS, Azure Blob), block storage (EBS, persistent disks), and backups. Customer-managed keys (CMK) on request.

In transit: TLS 1.3 by default, TLS 1.0 and 1.1 disabled on every endpoint. HSTS, secure cookies, modern cipher suites standard; mTLS internally where possible.

Key management: AWS KMS, GCP KMS, or Azure Key Vault. Keys rotated annually by default, on demand on request. Per-project key separation, never shared across tenants.

Secrets: HashiCorp Vault or AWS Secrets Manager, never source control, log files, email, or chat. Pre-commit hooks and CI scanners (TruffleHog, gitleaks) block accidental commits.

Access control and identity

Role-based access control (RBAC). Every system ships with RBAC. Permissions attach to roles, not users; roles are documented in the architecture document.

Single sign-on (SSO). SAML 2.0 and OIDC on every web application: Okta, Microsoft Entra ID, Google Workspace, Auth0, and more.

Multi-factor authentication (MFA). Mandatory for any account with production access, ours and yours. Hardware keys (YubiKey) preferred over TOTP for restricted-class systems.

Just-in-time elevated access. Nobody has permanent production admin. Access is granted through a logged approval workflow, expires automatically (typically 4 hours), and is fully audited.

Offboarding. Project access revoked the same business day an engineer rolls off. SSO groups, repositories, cloud IAM, and VPN key to one identity: one deprovisioning removes everything.

Audit logging

Every authentication event, privileged action, data export, configuration change, and admin action is written to an append-only immutable store (CloudWatch Logs with object-lock, or your SIEM of choice).

Default retention 13 months; longer configurable. Real-time shipping to your SIEM (Splunk, Datadog, Elastic, Sumo Logic) via Kinesis Data Firehose, Pub/Sub, or syslog on request.

Log access is itself logged: every read or query of an audit log is recorded.

Sub-processor list

These vendors may process client-related data on our behalf. We sign a Data Processing Agreement (DPA) with every sub-processor handling confidential or restricted data, and notify clients of material changes.

Sub-processor	Purpose	Region	DPA signed
Amazon Web Services	Compute, hosting, managed databases, storage	Client choice (UK, EU, US, AP)	Yes
Cloudflare	CDN, WAF, DDoS protection, edge DNS	Global edge	Yes
GitHub	Source code hosting, CI/CD, code review	US	Yes
Sentry	Error tracking, application performance monitoring	US or EU (per project)	Yes
Linear	Project management and issue tracking	US	Yes
Notion	Internal documentation, runbooks, knowledge base	US	Yes
Slack	Internal and client communication	US	Yes
Google Workspace	Email, calendar, internal documents	US / EU	Yes
Calendly	Consultation scheduling	US	Yes
Formspree	Marketing form submissions (this site)	US	Yes

Client production data never enters Notion, Linear, or Slack: project metadata and conversations only, never customer records.

Penetration testing and code scanning

Annual third-party penetration test. Corporate and a representative client production environment, tested annually by an independent CREST or OSCP-credentialled firm. Attestation letter available under NDA; per-project pen tests quoted as an add-on.

Static analysis (SAST). Every pull request scanned with Semgrep (OWASP Top 10, CWE Top 25). High-severity findings block the merge.

Dynamic analysis (DAST). OWASP ZAP runs against every staging deploy. New high findings open a P1 ticket automatically.

Software composition analysis (SCA). Snyk and Trivy scan dependencies, container images, and infrastructure-as-code. Critical CVEs trigger an immediate patch sprint; Dependabot and Renovate keep versions current.

Secret scanning. TruffleHog and gitleaks run on every push, and weekly on git history. Any leaked credential is a P1 incident.

Vulnerability disclosure

Found a security issue in an RG INSYS-operated system? Email [email protected] (PGP key on request). We acknowledge within 1 business day, triage within 5, and hold a 90-day responsible disclosure window.

No legal action against good-faith researchers. Credit in our advisories on request.

Business continuity and disaster recovery

Default targets for production systems we operate on your behalf:

RTO (Recovery Time Objective): 4 hours.
RPO (Recovery Point Objective): 1 hour.
Backups: automated, encrypted, daily full plus continuous WAL/PITR for managed Postgres, stored in a separate AWS account or KMS scope.
Multi-AZ: default for production; the application survives losing an entire availability zone.
Cross-region replication: on request, typically for restricted-class or regulated workloads.
DR drill: recovery exercise twice a year per managed project; findings feed the runbooks.

Where you operate production, we hand over runbooks, IaC, and a documented DR plan; on-call DR support under a separate retainer.

Incident response

Documented runbook based on NIST SP 800-61: prepare, detect, contain, eradicate, recover, post-mortem.

Notification. Confirmed incidents affecting client data are notified within 24 hours of confirmation: what we know, what we do not, systems involved, and containment steps taken.

Post-mortem. Written, blameless, root-cause focused, delivered within 5 business days of containment, with corrective actions, owners, and dates. Clients are welcome on the call.

Tabletop exercises. Quarterly internal drills: credential leak, ransomware on a developer laptop, cloud account compromise, sub-processor outage.

Employee security

Background checks. Identity, education, and prior-employment checks before any corporate identity or client access is issued.

Endpoint security. Corporate-issued laptops, full-disk encrypted (FileVault, BitLocker), managed via Jamf or Microsoft Intune, with EDR (CrowdStrike or Defender for Endpoint). USB mass storage blocked; patches pushed automatically.

Separation of devices. No client work on personal devices. Personal email and cloud storage are blocked from client repositories at the SSO and DLP layer.

Security training. Onboarding training plus quarterly refreshers, rolling phishing simulations, and secure-coding modules covering OWASP Top 10 and AI-assisted coding pitfalls.

Acceptable use. Signed at onboarding, re-attested annually. Covers shadow IT, password hygiene, AI tool usage, and incident reporting duties.

AI and LLM data handling

We use LLM coding assistants every day, and hold the data flowing through them to our strictest rules:

No client code to third-party model providers without explicit written consent. Default access uses zero-data-retention enterprise endpoints (Anthropic Claude API ZDR, OpenAI Enterprise no-training tier, GitHub Copilot Business with code-reference filtering).
Prompt redaction. PII, secrets, and restricted-class fields are stripped before prompts leave the developer machine, against a maintained per-project allow-list.
Auditability. Every LLM call against client repositories is logged with prompt hash, model, timestamp, and user. Reviewable by the client on request.
Local LLM option. For restricted-class workloads (PHI, payment data, defense, intelligence): on-premise or in-VPC open-weight models (Llama, Mistral, Qwen), so no prompt leaves your environment.
Per-project keys. Own API keys and usage budget per project, rotated quarterly and immediately on suspected compromise.
No training on client data. Signed addenda from our primary providers confirm client prompts are not used to train, fine-tune, or improve models.
Human review. Every line of AI-generated code is reviewed by a senior engineer before merge. AI does not push to production.