Software development security practices
protecting your systems, data and IP.
Asauvia signs an NDA before any confidential scoping, limits access to the people on your project, reviews every code change and dependency, and assigns IP in the work product to you on delivery or payment.
NDA and IP ownership,
agreed before work starts.
NDA before confidential scoping
We sign an NDA before any conversation that covers confidential details of your business, systems or plans. If the first call needs to go there, the NDA comes first.
IP assigned to you
IP in the work product is assigned to you on delivery or payment, as defined in the engagement agreement. The code we write for you is yours.
Access to your systems and data,
only as much as the work needs.
Access to your systems follows the people and the engagement, not the company.
- Access to your systems and data is scoped to the people actually working on your project.
- That access lasts for the duration of the engagement, not open-ended.
- Everyone with access is covered by the NDA signed before scoping began.
Secure software delivery,
built into the workflow, not bolted on.
Architecture documented up front
Architecture decisions are written down and reviewed with you before anything is built.
Code review
Changes go through code review before they are merged.
Dependency review
Every project gets a review of the third-party packages it relies on.
Testing and review gates
Nothing ships until it has passed the testing and review gates agreed for the project.
Performance budgets in CI
Core Web Vitals budgets are enforced in CI, so regressions are caught before release.
Monitoring and rollback
Launches go out with monitoring and a rollback path in place from day one.
Have specific security requirements?
Your organization may have its own security policies or vendor questionnaires. Raise them at the scoping call, so they are part of the scope and the proposal before any work starts.
Security questions
buyers usually ask.
When is the NDA signed?
Before any confidential scoping conversation. If your first call needs to cover confidential details, say so when you get in touch and the NDA comes first.
Who on your team can access our systems?
Only the people working on your project, for the duration of the engagement.
We have our own security requirements. When should we raise them?
At the scoping call. If your organization has its own security policies or vendor questionnaires, bringing them up before work starts means they are part of the scope and proposal from the beginning.
Who owns the code once the project is done?
You do. IP in the work product is assigned to you on delivery or payment, as defined in the engagement agreement.
Let's solve
something together.
Tell us what you're building, improving, or automating. We'll come back with a plan, not a pitch.
NDA before any scoping conversation