Security
How we handle your accounts, data and code.
The short version: hosting, domains and data live in accounts you own, we use the least access the job needs, and it is removed when the work ends.
01Access
We work inside your accounts.
Multi-factor authentication on every account we use for your work.
The least access the job needs, and only for as long as it needs it.
02Your data
Your data stays in systems you own.
Production data lives in your hosting and database accounts, not on our laptops.
We build and test against sample data wherever possible.
Australian hosting regions are used where the provider offers them and you need them.
03Code and deployments
Every change is tracked and can be rolled back.
All code is in a Git repository, with history from the first commit.
Secrets live in the hosting platform's environment settings, never in the code.
Changes go to a preview link first, then to production, so a bad release is one click to undo.
04Hand-back
When the work ends, so does our access.
A written list of every account, key and integration we touched.
Our access removed and any shared keys rotated at handover.
Documentation of how the system works and what to do when it breaks.
What we do not claim
We do not hold SOC 2 or ISO 27001 certification, and we will not imply that we do. What is on this page is how we actually work, and we are happy to put it in the contract.
Questions or a report
Send security questionnaires, questions about a project, or a report of something you have found to info@vetroxtech.com.au. We reply within one business day.
Have a security questionnaire?
Send it over, or book a call and we will go through it with you.